Rename CI credentials to org-wide names, demote non-secrets to variables

Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:

  vars.APP_ID / secrets.APP_PRIVATE_KEY   -> GHAPP_HEADERS_*
  secrets.APP_{ID,KEY}_APPROVE_AND_MERGE  -> GHAPP_MERGEBOT_*
  vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
  secrets.PB_BOT_APP_{ID,PRIVATE_KEY}     -> GHAPP_PBBOT_*

Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:

  secrets.POCKETBASE_URL        -> vars.POCKETBASE_URL
  secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
  secrets.FRONTEND_URL          -> vars.FRONTEND_URL (also replaces vars.SITE_URL)

The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:

  REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
  BREAKING_CHANGE_INGEST_SECRET               -> FRONTEND_ADVISORY_SECRET

PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.

.github/workflows/auto-update-app-headers.yml

@@ -24,8 +24,8 @@ jobs:
         id: generate-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.GHAPP_PR_ID }}
-          private-key: ${{ secrets.GHAPP_PR_PRIVATE_KEY }}
+          app-id: ${{ vars.GHAPP_HEADERS_ID }}
+          private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
 
       - name: Generate a token for PR approval and merge
         id: generate-token-merge

.github/workflows/changelog-archive.yml

@@ -21,8 +21,8 @@ jobs:
         id: generate-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.GHAPP_PR_ID }}
-          private-key: ${{ secrets.GHAPP_PR_PRIVATE_KEY }}
+          app-id: ${{ vars.GHAPP_HEADERS_ID }}
+          private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
 
       - name: Generate a token for PR approval and merge
         id: generate-token-merge

.github/workflows/changelog-pr.yml

@@ -26,8 +26,8 @@ jobs:
         id: generate-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.GHAPP_PR_ID }}
-          private-key: ${{ secrets.GHAPP_PR_PRIVATE_KEY }}
+          app-id: ${{ vars.GHAPP_HEADERS_ID }}
+          private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
 
       - name: Generate a token for PR approval and merge
         id: generate-token-merge

CHANGELOG.md

@@ -540,7 +540,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
-    - openwebui: add UV_HTTP_TIMEOUT and retry loop to prevent uv install hangs [@MickLesk](https://github.com/MickLesk) ([#16917](https://github.com/community-scripts/ProxmoxVE/pull/16917))
     - bambuddy: force asyncio loop, uvloop breaks camera proxy handlers [@MickLesk](https://github.com/MickLesk) ([#16904](https://github.com/community-scripts/ProxmoxVE/pull/16904))
     - bookorbit: raise service start timeout, migration can exceed systemd default [@MickLesk](https://github.com/MickLesk) ([#16860](https://github.com/community-scripts/ProxmoxVE/pull/16860))
     - node-red: remove --unsafe-perm flag [@MickLesk](https://github.com/MickLesk) ([#16859](https://github.com/community-scripts/ProxmoxVE/pull/16859))
@@ -552,9 +551,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🔧 Refactor
 
-    - omv: migrate to new package repo host (packages.openmediavault.org) is dead [@MickLesk](https://github.com/MickLesk) ([#16918](https://github.com/community-scripts/ProxmoxVE/pull/16918))
-    - yuvomi/aurral: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16914](https://github.com/community-scripts/ProxmoxVE/pull/16914))
-    - vaultwarden: relax cargo release profile via env vars to avoid build OOM [@MickLesk](https://github.com/MickLesk) ([#16915](https://github.com/community-scripts/ProxmoxVE/pull/16915))
     - kima-hub/maintainerr/planka/spliit: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16905](https://github.com/community-scripts/ProxmoxVE/pull/16905))
     - gatus: pin Go toolchain to gatus's own go.mod version [@MickLesk](https://github.com/MickLesk) ([#16893](https://github.com/community-scripts/ProxmoxVE/pull/16893))
     - immich: tolerate enable-maintenance-mode crash, same as disable-maintenance-mode [@MickLesk](https://github.com/MickLesk) ([#16866](https://github.com/community-scripts/ProxmoxVE/pull/16866))

ct/aurral.sh

@@ -38,7 +38,6 @@ function update_script() {
     msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "aurral" "lklynet/aurral" "tarball"
-    NODE_VERSION="26" setup_nodejs
 
     msg_info "Updating Aurral"
     cd /opt/aurral

ct/karakeep.sh

@@ -1,7 +1,5 @@
 #!/usr/bin/env bash
-_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 tteck
 # Author: MickLesk (Canbiz) & vhsdream
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/omv.sh

@@ -1,7 +1,5 @@
 #!/usr/bin/env bash
-_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
@@ -30,14 +28,6 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-
-  if grep -q "packages.openmediavault.org" /etc/apt/sources.list.d/openmediavault.list; then
-    msg_info "Migrating OpenMediaVault package repository"
-    curl -fsSL "https://openmediavault.github.io/packages/archive.key" | gpg --dearmor >"/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg"
-    sed -i 's#https\?://packages.openmediavault.org/public#https://openmediavault.github.io/packages#' /etc/apt/sources.list.d/openmediavault.list
-    msg_ok "Migrated OpenMediaVault package repository"
-  fi
-
   msg_info "Updating ${APP} LXC"
   $STD apt update
   $STD apt -y upgrade

ct/openwebui.sh

@@ -50,11 +50,7 @@ function update_script() {
 
     msg_info "Installing uv-based Open-WebUI"
     PYTHON_VERSION="3.12" setup_uv
-    export UV_HTTP_TIMEOUT=300
-    for attempt in $(seq 1 3); do
-      $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] && break
-      [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
-    done
+    $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all]
     msg_ok "Installed uv-based Open-WebUI"
 
     msg_info "Restoring data"
@@ -127,11 +123,7 @@ EOF
       OTEL_ARGS+=(--with "$pkg")
     done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1)
   fi
-  export UV_HTTP_TIMEOUT=300
-  for attempt in $(seq 1 3); do
-    $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
-    [[ $attempt -lt 3 ]] && msg_warn "Open WebUI update attempt $attempt failed, retrying..." && sleep 10
-  done
+  $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all]
   systemctl restart open-webui
   msg_ok "Updated Open WebUI"
   msg_ok "Updated successfully!"

ct/vaultwarden.sh

@@ -64,7 +64,7 @@ update_deb_based() {
       cd /tmp/vaultwarden-src
       VW_VERSION="$VAULT"
       export VW_VERSION
-      CARGO_BUILD_JOBS="$(get_parallel_jobs)" CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 $STD cargo build --features "sqlite,mysql,postgresql" --release
+      $STD cargo build --features "sqlite,mysql,postgresql" --release
       if [[ -f /usr/bin/vaultwarden ]]; then
         cp target/release/vaultwarden /usr/bin/
       else

ct/yuvomi.sh

@@ -1,7 +1,5 @@
 #!/usr/bin/env bash
-_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
@@ -40,7 +38,6 @@ function update_script() {
     create_backup /opt/yuvomi/data /opt/yuvomi/.env
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
-    NODE_VERSION="24" setup_nodejs
 
     msg_info "Installing Node.js Dependencies"
     cd /opt/yuvomi

install/aurral-install.sh

@@ -22,7 +22,7 @@ $STD apt install -y \
   fonts-dejavu-core
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="26" setup_nodejs
+NODE_VERSION="22" setup_nodejs
 
 fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "yt-dlp"
 fetch_and_deploy_gh_release "aurral" "lklynet/aurral" "tarball"

install/omv-install.sh

@@ -14,9 +14,9 @@ network_check
 update_os
 
 msg_info "Installing OpenMediaVault (Patience)"
-curl -fsSL "https://openmediavault.github.io/packages/archive.key" | gpg --dearmor >"/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg"
+curl -fsSL "https://packages.openmediavault.org/public/archive.key" | gpg --dearmor >"/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg"
 cat <<EOF >/etc/apt/sources.list.d/openmediavault.list
-deb [signed-by=/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg] https://openmediavault.github.io/packages sandworm main
+deb [signed-by=/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg] http://packages.openmediavault.org/public sandworm main
 EOF
 
 export LANG=C.UTF-8

install/openwebui-install.sh

@@ -46,11 +46,7 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
 fi
 
 msg_info "Installing Open WebUI"
-export UV_HTTP_TIMEOUT=300
-for attempt in $(seq 1 3); do
-  $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
-  [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
-done
+$STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all]
 msg_ok "Installed Open WebUI"
 
 read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt

install/vaultwarden-install.sh

@@ -32,7 +32,7 @@ setup_deb_based() {
   cd /tmp/vaultwarden-src
   VW_VERSION=$(get_latest_github_release "dani-garcia/vaultwarden")
   export VW_VERSION
-  CARGO_BUILD_JOBS="$(get_parallel_jobs)" CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 $STD cargo build --features "sqlite,mysql,postgresql" --release
+  $STD cargo build --features "sqlite,mysql,postgresql" --release
   msg_ok "Built Vaultwarden"
 
   msg_info "Setting up Vaultwarden"

install/yuvomi-install.sh

@@ -21,7 +21,7 @@ $STD apt install -y \
   libsqlcipher-dev
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="22" setup_nodejs
 
 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"