Skip to content
PR Automation

feat(plugin-security)!: a flow that runs as system writes no identity assignment #36148

Sign in to view logs

feat(plugin-security)!: a flow that runs as system writes no identity assignment

feat(plugin-security)!: a flow that runs as system writes no identity assignment #36148

Triggered via pull request October 23, 2026 15:41
@objectstack-fleetobjectstack-fleet[bot]
opened #25483
claude/project-thread-t123rb
Status Success
Total duration 1m 41s
Artifacts –

pr-automation.yml

on: pull_request
Check PR Size
27s
Check PR Size
Check Changeset
1m 37s
Check Changeset
Auto Label
29s
Auto Label
Fit to window
Zoom out
Zoom in

Annotations

4 notices
Check PR Size
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Auto Label
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Check Changeset: .changeset/25251-flow-system-identity-write-refusal.md#L0
ADR-0087 exemption (no-migration-prescription): No key of any metadata schema is added, removed, renamed or re-shaped: `runAs` keeps its two values and every flow still saves, so there is nothing for `objectstack migrate meta` to rewrite and no tombstone. What changes is what `runAs: 'system'` lets a flow's data nodes write, which is the semantic entry the spec lane records under ADR-0087 D3 beside the `runAs` describe sentence. The author's migration is an authoring choice no rewrite can make for them: set the flow's `runAs` to `'user'` so the delegated-administration gate judges the user it acts for, or move invitation and membership changes to the organization endpoints, as the refusal itself says.
Check Changeset
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"