smolkik_adm/ProxmoxVE
1
0
Fork 0
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-09-13 17:26:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Rename CI credentials to org-wide names, demote non-secrets to variables

Browse Source 
Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:

  vars.APP_ID / secrets.APP_PRIVATE_KEY   -> GHAPP_HEADERS_*
  secrets.APP_{ID,KEY}_APPROVE_AND_MERGE  -> GHAPP_MERGEBOT_*
  vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
  secrets.PB_BOT_APP_{ID,PRIVATE_KEY}     -> GHAPP_PBBOT_*

Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:

  secrets.POCKETBASE_URL        -> vars.POCKETBASE_URL
  secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
  secrets.FRONTEND_URL          -> vars.FRONTEND_URL (also replaces vars.SITE_URL)

The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:

  REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
  BREAKING_CHANGE_INGEST_SECRET               -> FRONTEND_ADVISORY_SECRET

PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.
This commit is contained in:
MickLesk
2026-08-31 16:03:17 +02:00
parent 12c6e86cf2
commit 7481db59e1
11 changed files with 41 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/auto-update-app-headers.yml generated vendored
View File

@@ -24,15 +24,15 @@ jobs:
id: generate-token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
app-id: ${{ vars.GHAPP_HEADERS_ID }}
private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
- name: Generate a token for PR approval and merge
id: generate-token-merge
uses: actions/create-github-app-token@v3
with:
app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
app-id: ${{ vars.GHAPP_MERGEBOT_ID }}
private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }}
# Step 1: Checkout repository
- name: Checkout repository