Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:
vars.APP_ID / secrets.APP_PRIVATE_KEY -> GHAPP_HEADERS_*
secrets.APP_{ID,KEY}_APPROVE_AND_MERGE -> GHAPP_MERGEBOT_*
vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
secrets.PB_BOT_APP_{ID,PRIVATE_KEY} -> GHAPP_PBBOT_*
Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:
secrets.POCKETBASE_URL -> vars.POCKETBASE_URL
secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
secrets.FRONTEND_URL -> vars.FRONTEND_URL (also replaces vars.SITE_URL)
The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:
REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
BREAKING_CHANGE_INGEST_SECRET -> FRONTEND_ADVISORY_SECRET
PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.
* docker-vm, pve-privilege-converter: source from GitHub raw instead of gitea mirror
* docker-vm, pve-privilege-converter, vm-core.func: source from GitHub raw instead of gitea mirror
* Post the command that tests a ct/ or install/ change
Reviewing a script change meant working out the URL yourself, and the
obvious guess is wrong: curling the branch URL alone gives you the ct/
script from the PR and the install/ script from main, because each script
pins _CS_DEFAULT_URL to main and that pin is what fills
COMMUNITY_SCRIPTS_URL when it is unset. Frequently the install script is
the only thing that changed.
So the comment spells out both lines, per changed app.
Only for scripts already on the core bootstrap. The older one-liner
resolves everything from ProxmoxVE/main and ignores the variable, so a
command built for it would install main and look like it passed -- worse
than no comment. Those are named instead, with what to do about them.
pull_request_target for fork PRs, and nothing from the PR is checked out
or executed: the file list and the bootstrap line come from the API, and
a branch name that is not [A-Za-z0-9._/-]+ stops the run rather than
reaching a fenced code block.
* Update .github/workflows/pr-test-command.yml
Co-authored-by: Sam Heinz <sam@samheinz.com>
---------
Co-authored-by: Sam Heinz <sam@samheinz.com>
* calibre-web: point cps at explicit db path, src-layout package has no default anymore
* calibre-web: fix empty-library bootstrap, migrate pre-existing library on update
