fix(run): address the #1128 review findings

.github/actions/install/action.yml

@@ -1,18 +1,6 @@
 name: Install Codefly
 description: Install the Codefly CLI version pinned by this action reference
 
-inputs:
-  authority-token:
-    description: >-
-      A token with contents read access to codefly-dev/authority, which is private and whose
-      interface client, hop and delivery libraries the CLI requires. The CLI
-      workflows use the existing organization GH_PAT secret. It reaches git
-      for the build step alone. Without it the build resolves from the module
-      cache only, so a workflow that has not downloaded the CLI's modules
-      already cannot install it.
-    required: false
-    default: ""
-
 runs:
   using: composite
   steps:
@@ -26,20 +14,13 @@ runs:
       shell: bash
       env:
         CODEFLY_REPOSITORY_ROOT: ${{ github.action_path }}/../../..
-        AUTHORITY_TOKEN: ${{ inputs.authority-token }}
-        GOPRIVATE: github.com/codefly-dev/authority
       run: |
         set -euo pipefail
         install_root="${RUNNER_TEMP}/codefly-action/bin"
         mkdir -p "${install_root}"
         (
           cd "${CODEFLY_REPOSITORY_ROOT}"
-          export GOWORK=off
-          if [ -n "${AUTHORITY_TOKEN}" ]; then
-            .github/scripts/download-go-modules.sh
-          fi
-          unset AUTHORITY_TOKEN
-          GOBIN="${install_root}" go install ./cmd/codefly
+          GOWORK=off GOBIN="${install_root}" go install ./cmd/codefly
         )
         test -x "${install_root}/codefly"
         echo "${install_root}" >> "${GITHUB_PATH}"

.github/dependabot.yml

@@ -56,7 +56,6 @@ updates:
     directories:
       - /
       - /.github/actions/install
-      - /.github/actions/read-authority
     schedule:
       interval: weekly
     open-pull-requests-limit: 1

.github/workflows/companions.yaml

@@ -36,12 +36,6 @@ concurrency:
   group: companions-publish
   cancel-in-progress: false
 
-env:
-  # The CLI requires codefly-dev/authority's libraries, and that repository is
-  # private: fetched from GitHub with the existing organization GH_PAT, never via the
-  # module proxy or the checksum database (go.yml says how).
-  GOPRIVATE: github.com/codefly-dev/authority
-
 jobs:
   publish:
     name: Publish and verify companion images
@@ -88,16 +82,9 @@ jobs:
           go-version-file: cli/go.mod
           cache: false
 
-      # The token reaches git in the download alone; the build reads the cache.
       - name: Build the codefly CLI
         working-directory: cli
-        env:
-          AUTHORITY_TOKEN: ${{ secrets.GH_PAT }}
-          GOWORK: "off"
-        run: |
-          .github/scripts/download-go-modules.sh
-          unset AUTHORITY_TOKEN
-          GOBIN="${{ github.workspace }}/bin" go install ./cmd/codefly
+        run: GOWORK=off GOBIN="${{ github.workspace }}/bin" go install ./cmd/codefly
 
       # A multi-platform buildx push builds every image as one manifest, so the
       # arm64 stages need an emulator (QEMU) and a builder that can emit a
@@ -241,16 +228,9 @@ jobs:
           go-version-file: cli/go.mod
           cache: false
 
-      # The token reaches git in the download alone; the build reads the cache.
       - name: Build the codefly CLI
         working-directory: cli
-        env:
-          AUTHORITY_TOKEN: ${{ secrets.GH_PAT }}
-          GOWORK: "off"
-        run: |
-          .github/scripts/download-go-modules.sh
-          unset AUTHORITY_TOKEN
-          GOBIN="${{ github.workspace }}/bin" go install ./cmd/codefly
+        run: GOWORK=off GOBIN="${{ github.workspace }}/bin" go install ./cmd/codefly
 
       - name: Verify linux/arm64 assets for the qualification fixtures
         # Test inputs only: these identities never select production agents or

.github/workflows/container-recovery-native.yml

@@ -14,12 +14,6 @@ on:
 permissions:
   contents: read
 
-env:
-  # The CLI requires codefly-dev/authority's libraries, and that repository is
-  # private: fetched from GitHub with the existing organization GH_PAT, never via the
-  # module proxy or the checksum database (go.yml says how).
-  GOPRIVATE: github.com/codefly-dev/authority
-
 concurrency:
   group: container-recovery-native-${{ github.ref }}
   cancel-in-progress: true
@@ -59,14 +53,6 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
-      # Reading the CLI's Core pin and the qualification test below resolve
-      # the CLI's modules from the cache this fills; only this step has the
-      # token.
-      - name: Download the CLI's modules
-        env:
-          GOWORK: 'off'
-          AUTHORITY_TOKEN: ${{ secrets.GH_PAT }}
-        run: .github/scripts/download-go-modules.sh
       - name: Check out the ${{ matrix.agent }} agent source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/go.yml

@@ -22,16 +22,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-env:
-  # The CLI requires codefly-dev/authority's interface client, hop and delivery
-  # libraries, and that repository is private: fetched from GitHub with the
-  # existing organization GH_PAT (handed to git by
-  # .github/scripts/download-go-modules.sh for the download step alone), never
-  # via the module proxy or the checksum database. GOPRIVATE is the default of
-  # both GONOPROXY and GONOSUMDB. Every other codefly-dev module is public and
-  # stays on the proxy and the checksum database.
-  GOPRIVATE: github.com/codefly-dev/authority
-
 jobs:
   quality:
     name: ${{ matrix.gate }}
@@ -98,22 +88,15 @@ jobs:
           restore-keys: |
             cli-go-build-v3-${{ matrix.gate }}-${{ runner.os }}-
 
-      # Every gate resolves the CLI's modules, codefly-dev/authority's among
-      # them. The token is handed to the install action and the download step
-      # only; nothing writes it into git's configuration.
       # This is both the canonical bootstrap and the cross-repository action
       # contract consumed by Codefly products. Dogfood the local action so a
       # release cannot publish an installer that CI never exercised.
       - name: install Codefly
         if: matrix.gate == 'bootstrap-audit' || matrix.gate == 'control-integration'
         uses: ./.github/actions/install
-        with:
-          authority-token: ${{ secrets.GH_PAT }}
 
       - name: Install Dependencies
-        env:
-          AUTHORITY_TOKEN: ${{ secrets.GH_PAT }}
-        run: .github/scripts/download-go-modules.sh
+        run: go mod download
 
       # govulncheck gate via the CLI (replaces scripts/govulncheck.sh):
       # suppressions + staleness from .govulncheck.yaml, fails only on
@@ -303,14 +286,6 @@ jobs:
           go-version-file: go.mod
           cache: false
 
-      # The linter loads every package, so the modules must be in the cache
-      # before it runs, codefly-dev/authority's among them; the linter itself
-      # never sees the token.
-      - name: Download the CLI's modules
-        env:
-          AUTHORITY_TOKEN: ${{ secrets.GH_PAT }}
-        run: .github/scripts/download-go-modules.sh
-
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:

.github/workflows/release.yaml

@@ -15,16 +15,6 @@ permissions:
   attestations: write
   artifact-metadata: write
 
-env:
-  # The CLI requires codefly-dev/authority's interface client, hop and delivery
-  # libraries, and that repository is private: fetched from GitHub with the
-  # existing organization GH_PAT, never via the module proxy or the checksum database
-  # (GOPRIVATE is the default of GONOPROXY and GONOSUMDB). The release builds
-  # from a module cache the host fills before any build; the token never enters
-  # the release container. This is why releases are the install path: a
-  # `go install` from outside the organization cannot read the repository.
-  GOPRIVATE: github.com/codefly-dev/authority
-
 jobs:
   release:
     name: Qualify and publish
@@ -42,17 +32,6 @@ jobs:
           go-version-file: go.mod
           cache: false
 
-      # The module cache lives under RUNNER_TEMP, which the release container
-      # mounts at the same path, so the container builds every target from what
-      # this step downloaded and needs no credential of its own.
-      - name: Download the CLI's modules
-        env:
-          AUTHORITY_TOKEN: ${{ secrets.GH_PAT }}
-        run: |
-          gomodcache="$RUNNER_TEMP/gomodcache"
-          echo "GOMODCACHE=$gomodcache" >> "$GITHUB_ENV"
-          GOMODCACHE="$gomodcache" .github/scripts/download-go-modules.sh
-
       - name: Install Syft
         id: syft
         uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
@@ -101,8 +80,6 @@ jobs:
           # tag is qualified with CGO and real compilers for every target.
           docker run --rm \
             -e CODEFLY_RELEASE_SIGNING_KEY_PATH \
-            -e GOMODCACHE \
-            -e GOPRIVATE \
             -e RELEASE_TAG \
             -v "$GITHUB_WORKSPACE:/workspace" \
             -v "$RUNNER_TEMP:$RUNNER_TEMP" \
@@ -112,8 +89,6 @@ jobs:
             check
           docker run --rm \
             -e CODEFLY_RELEASE_SIGNING_KEY_PATH \
-            -e GOMODCACHE \
-            -e GOPRIVATE \
             -e RELEASE_TAG \
             -v "$GITHUB_WORKSPACE:/workspace" \
             -v "$RUNNER_TEMP:$RUNNER_TEMP" \
@@ -160,8 +135,6 @@ jobs:
           docker run --rm \
             -e CODEFLY_RELEASE_SIGNING_KEY_PATH \
             -e GITHUB_TOKEN \
-            -e GOMODCACHE \
-            -e GOPRIVATE \
             -e GH_TOKEN \
             -e HOMEBREW_TAP_GITHUB_TOKEN \
             -e MACOS_SIGN_P12 \

AGENTS.md

@@ -8,7 +8,7 @@
 
 - **Module:** `github.com/codefly-dev/cli`
 - **Repository:** `https://github.com/codefly-dev/cli`
-- **Language:** Go 1.27.2 (`go.mod` is the source of truth — see [Bump the Go version](docs/runbooks/bump-go-version.md))
+- **Language:** Go 1.27.3 (`go.mod` is the source of truth — see [Bump the Go version](docs/runbooks/bump-go-version.md))
 
 The CLI is the primary interface for codefly. It orchestrates agent lifecycles, manages the
 daemon, runs services with their dependency graphs, and exposes an MCP server for AI tool

README.md

@@ -22,20 +22,6 @@ GitHub release for each immutable version. See [CLI releases and
 updates](docs/cli-updates.md) for direct installation, update commands,
 verification, rollback, and package-manager ownership.
 
-The release is the install path. The CLI requires libraries from
-`codefly-dev/authority`, which is a private repository, so `go install
-github.com/codefly-dev/cli/...` (the CLI or `codefly-help`) is not supported
-from outside the codefly-dev organization while that repository stays private:
-the module proxy cannot serve it and `go` cannot fetch it without read access.
-Releases ship prebuilt, signed binaries and need no access to it.
-
-Building from source needs read access to `codefly-dev/authority` and
-`GOPRIVATE=github.com/codefly-dev/authority`, so `go` fetches it with git
-(your own credentials) rather than asking the public proxy and checksum
-database. CI reads it with the organization's CI reader app
-(`.github/actions/read-authority`, handed to git for the download step alone by
-`.github/scripts/download-go-modules.sh`).
-
 # Development
 
 ## Repository layout

cmd/ci/deploy.go

@@ -4,10 +4,9 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/codefly-dev/cli/pkg/gitops"
-
 	"github.com/codefly-dev/cli/cmd/common"
 	"github.com/codefly-dev/cli/pkg/cli"
+	"github.com/codefly-dev/cli/pkg/gitops"
 	"github.com/codefly-dev/cli/pkg/orchestration"
 	"github.com/codefly-dev/cli/pkg/platform"
 	"github.com/codefly-dev/core/resources"
@@ -72,7 +71,12 @@ func initDeployService(ctx context.Context, workspace *resources.Workspace, modu
 		return nil, nil, w.Wrap(err)
 	}
 
-	flow, err := orchestration.NewFlow(ctx, workspace, module, service, env, orchestration.DeployMode, orchestration.WithCompositionCheck(gitops.PermissionPreflight(true)), orchestration.WithRunModuleClosure(module.Name))
+	// The modules `deploy service` checks, the same way, before any effect; the
+	// deploy graph itself is the one a deployment has always taken.
+	if err = gitops.CheckCompositionPermissions(ctx, workspace, env, true, module.Name); err != nil {
+		return nil, nil, w.Wrap(err)
+	}
+	flow, err := orchestration.NewFlow(ctx, workspace, module, service, env, orchestration.DeployMode)
 	if err != nil {
 		return nil, nil, w.Wrap(err)
 	}