mirror of
https://github.com/community-scripts/ProxmoxVE.git
synced 2026-09-13 17:26:43 +00:00
7481db59e1
Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:
vars.APP_ID / secrets.APP_PRIVATE_KEY -> GHAPP_HEADERS_*
secrets.APP_{ID,KEY}_APPROVE_AND_MERGE -> GHAPP_MERGEBOT_*
vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
secrets.PB_BOT_APP_{ID,PRIVATE_KEY} -> GHAPP_PBBOT_*
Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:
secrets.POCKETBASE_URL -> vars.POCKETBASE_URL
secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
secrets.FRONTEND_URL -> vars.FRONTEND_URL (also replaces vars.SITE_URL)
The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:
REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
BREAKING_CHANGE_INGEST_SECRET -> FRONTEND_ADVISORY_SECRET
PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.
59 lines
2.2 KiB
YAML
Generated
59 lines
2.2 KiB
YAML
Generated
name: Notify breaking change
|
|
|
|
# When a PR labelled "breaking change" is merged, tell the Helper-Scripts site
|
|
# so it can show a temporary advisory on the affected scripts. The site pulls
|
|
# the PR itself and re-verifies it is merged + labelled, so this workflow only
|
|
# has to hand over the PR number.
|
|
#
|
|
# Requires one repo secret:
|
|
# BREAKING_CHANGE_INGEST_SECRET — must match the value the site runs with.
|
|
# Site URL is taken from the existing FRONTEND_URL secret, then an optional
|
|
# SITE_URL variable, then a hard default.
|
|
#
|
|
# pull_request_target (not pull_request) so the run has access to the secret
|
|
# even for fork PRs. It is safe here: the job never checks out or runs PR code —
|
|
# it only forwards the number after the PR has merged.
|
|
|
|
on:
|
|
pull_request_target:
|
|
# closed -> fires on the merge itself
|
|
# labeled -> fires if the label is added to an already-merged PR
|
|
types: [closed, labeled]
|
|
|
|
concurrency:
|
|
group: notify-breaking-change-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
notify:
|
|
if: >-
|
|
github.event.pull_request.merged == true &&
|
|
contains(github.event.pull_request.labels.*.name, 'breaking change')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Notify site of breaking change
|
|
env:
|
|
INGEST_SECRET: ${{ secrets.FRONTEND_ADVISORY_SECRET }}
|
|
SITE_URL: ${{ vars.FRONTEND_URL || 'https://community-scripts.org' }}
|
|
PR: ${{ github.event.pull_request.number }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${INGEST_SECRET:-}" ]; then
|
|
echo "::error::BREAKING_CHANGE_INGEST_SECRET secret is not set."
|
|
exit 1
|
|
fi
|
|
url="${SITE_URL%/}/api/breaking-changes/ingest"
|
|
echo "Notifying $url for PR #${PR}"
|
|
status="$(curl -sS -o response.json -w '%{http_code}' \
|
|
-X POST "$url" \
|
|
-H "Authorization: Bearer ${INGEST_SECRET}" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"pr\": ${PR}}")"
|
|
echo "HTTP $status"
|
|
cat response.json || true
|
|
echo
|
|
if [ "$status" != "200" ]; then
|
|
echo "::error::ingest endpoint returned HTTP $status"
|
|
exit 1
|
|
fi
|