smolkik_adm/ProxmoxVE
1
0
Fork 0
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-09-13 09:16:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Rename CI credentials to org-wide names, demote non-secrets to variables

Browse Source 
Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:

  vars.APP_ID / secrets.APP_PRIVATE_KEY   -> GHAPP_HEADERS_*
  secrets.APP_{ID,KEY}_APPROVE_AND_MERGE  -> GHAPP_MERGEBOT_*
  vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
  secrets.PB_BOT_APP_{ID,PRIVATE_KEY}     -> GHAPP_PBBOT_*

Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:

  secrets.POCKETBASE_URL        -> vars.POCKETBASE_URL
  secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
  secrets.FRONTEND_URL          -> vars.FRONTEND_URL (also replaces vars.SITE_URL)

The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:

  REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
  BREAKING_CHANGE_INGEST_SECRET               -> FRONTEND_ADVISORY_SECRET

PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.
This commit is contained in:
MickLesk
2026-08-31 16:03:17 +02:00
parent 12c6e86cf2
commit 7481db59e1
11 changed files with 41 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.github/workflows/pocketbase-bot.yml generated vendored
View File

@@ -19,8 +19,8 @@ jobs:
steps:
- name: Execute PocketBase bot command
env:
POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
COMMENT_BODY: ${{ github.event.comment.body }}
@@ -31,12 +31,12 @@ jobs:
ACTOR: ${{ github.event.comment.user.login }}
ACTOR_ASSOCIATION: ${{ github.event.comment.author_association }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
FRONTEND_URL: ${{ secrets.FRONTEND_URL }}
REVALIDATE_SECRET: ${{ secrets.REVALIDATE_SECRET }}
FRONTEND_URL: ${{ vars.FRONTEND_URL }}
REVALIDATE_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
# Screenshot attaching is delegated to the frontend, which owns the
# fetching and validation. Without this the subcommand says so rather
# than failing halfway.
SCREENSHOT_IMPORT_SECRET: ${{ secrets.SCREENSHOT_IMPORT_SECRET }}
SCREENSHOT_IMPORT_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
run: |
node << 'ENDSCRIPT'
(async function () {