agw/gtk-ahfail
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Read the tarball host from a secret, not a variable

Browse Source 
Run logs of a public repository are public, and Gitea prints variables in
them in clear text; only secrets are masked.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
This commit is contained in:
Asger Geel Weirsøe
2026-10-01 17:42:00 +02:00
parent 630cb54332
commit e6dfd7814c
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/aur-publish.yml
+3 -3
View File
@@ -116,7 +116,7 @@ jobs:
printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
chmod 600 ~/.ssh/tarballz chmod 600 ~/.ssh/tarballz
ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \ ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
"${{ vars.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD "${{ secrets.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD
# ahfail-bin: the same release, prebuilt. The binary is built from the TAG # ahfail-bin: the same release, prebuilt. The binary is built from the TAG
# (also when this runs by hand from master), staged as a `meson install` tree, # (also when this runs by hand from master), staged as a `meson install` tree,
@@ -186,7 +186,7 @@ jobs:
# Forced command on the web host: this key may only write ahfail-*.tar.* # Forced command on the web host: this key may only write ahfail-*.tar.*
# and ahfail-bin.PKGBUILD, and keeps the newest three tarballs. # and ahfail-bin.PKGBUILD, and keeps the newest three tarballs.
ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \ ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
"${{ vars.TARBALLZ_TARGET }}" "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}" "${{ secrets.TARBALLZ_TARGET }}" "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
- name: Verify the public URL serves the same bytes - name: Verify the public URL serves the same bytes
run: | run: |
@@ -244,4 +244,4 @@ jobs:
continue-on-error: true continue-on-error: true
run: | run: |
ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \ ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
"${{ vars.TARBALLZ_TARGET }}" < aur-bin-pkg/PKGBUILD "${{ secrets.TARBALLZ_TARGET }}" < aur-bin-pkg/PKGBUILD