mirror of
https://github.com/community-scripts/ProxmoxVE.git
synced 2026-09-13 17:26:43 +00:00
7481db59e1
Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:
vars.APP_ID / secrets.APP_PRIVATE_KEY -> GHAPP_HEADERS_*
secrets.APP_{ID,KEY}_APPROVE_AND_MERGE -> GHAPP_MERGEBOT_*
vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
secrets.PB_BOT_APP_{ID,PRIVATE_KEY} -> GHAPP_PBBOT_*
Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:
secrets.POCKETBASE_URL -> vars.POCKETBASE_URL
secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
secrets.FRONTEND_URL -> vars.FRONTEND_URL (also replaces vars.SITE_URL)
The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:
REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
BREAKING_CHANGE_INGEST_SECRET -> FRONTEND_ADVISORY_SECRET
PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.
57 lines
2.0 KiB
YAML
Generated
57 lines
2.0 KiB
YAML
Generated
name: Sync ct/install to Incus
|
|
|
|
# When a ct/*.sh or install/*.sh file changes on main, trigger the Incus repo's
|
|
# own sync workflow immediately instead of waiting for its daily 04:00 cron.
|
|
#
|
|
# The actual mirroring + transformation lives in community-scripts/Incus
|
|
# (.github/workflows/sync-scripts.yml): it rewrites each script's bootstrap line
|
|
# to load the engine from community-scripts/core (ProxmoxVE's misc/build.func is
|
|
# a monolith with no Incus backend), so a plain 1:1 copy would break every Incus
|
|
# script. We therefore only fire a repository_dispatch and let that single
|
|
# source of truth do the work (and auto-approve + merge its own PR).
|
|
#
|
|
# Auth: the "push-app-to-main" GitHub App (vars.GHAPP_SYNC_ID /
|
|
# secrets.GHAPP_SYNC_PRIVATE_KEY), scoped to community-scripts/Incus. It has
|
|
# contents:write, which repository_dispatch requires (community-scripts-pr-app
|
|
# only has pull_requests:write, so it cannot dispatch). The app must be
|
|
# installed on the Incus repo.
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- "ct/**.sh"
|
|
- "install/**.sh"
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: sync-to-incus
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
dispatch:
|
|
if: github.repository == 'community-scripts/ProxmoxVE'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Generate token (dispatch to Incus)
|
|
id: token
|
|
uses: actions/create-github-app-token@v3
|
|
with:
|
|
app-id: ${{ vars.GHAPP_SYNC_ID }}
|
|
private-key: ${{ secrets.GHAPP_SYNC_PRIVATE_KEY }}
|
|
owner: community-scripts
|
|
repositories: Incus
|
|
|
|
- name: Trigger Incus sync workflow
|
|
env:
|
|
GH_TOKEN: ${{ steps.token.outputs.token }}
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
echo "Dispatching proxmoxve-scripts-changed to community-scripts/Incus (from ${SOURCE_SHA})"
|
|
gh api repos/community-scripts/Incus/dispatches \
|
|
-X POST \
|
|
-f "event_type=proxmoxve-scripts-changed" \
|
|
-F "client_payload[sha]=${SOURCE_SHA}"
|