From 9670afa6d4598eb58013a993e697b098a2f99fe3 Mon Sep 17 00:00:00 2001 From: agw Date: Thu, 1 Oct 2026 17:48:00 +0200 Subject: [PATCH] Read the tarball host and path from secrets, not variables Run logs of a public repository are public, and Gitea prints variables in them in clear text; only secrets are masked. They are now set only on the publish step, the one step that needs them. Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9 --- .gitea/workflows/build.yml | 6 ++++-- README.md | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 697ede4..3987b0a 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -32,8 +32,6 @@ concurrency: # host, state.json or the AUR. env: AUR_MAINTAINER: ${{ vars.AUR_MAINTAINER }} - TARBALL_HOST: ${{ vars.TARBALL_HOST }} - TARBALL_PATH: ${{ vars.TARBALL_PATH }} TARBALL_BASE_URL: ${{ vars.TARBALL_BASE_URL }} WORK_DIR: /work @@ -126,6 +124,10 @@ jobs: if: vars.PUBLISH == 'true' env: TARBALL_SSH_KEY: ${{ secrets.TARBALL_SSH_KEY }} + # Secrets, not variables: run logs of a public repo are public, and + # Gitea prints variables in them but masks secrets. + TARBALL_HOST: ${{ secrets.TARBALL_HOST }} + TARBALL_PATH: ${{ secrets.TARBALL_PATH }} run: | ASSET="$(python3 -c 'import json;print(json.load(open("release-meta.json"))["tarball"])')" bash scripts/publish-tarball.sh "${WORK_DIR}/out/${ASSET}" diff --git a/README.md b/README.md index 5f904e9..ec1363a 100644 --- a/README.md +++ b/README.md @@ -96,8 +96,6 @@ Set these in the Gitea repo before the first run. | Name | Example | Meaning | | --- | --- | --- | | `AUR_MAINTAINER` | `Asger Geel Weirsoe ` | Written into the PKGBUILD header. The guidelines suggest obfuscating the address against spam harvesting. | -| `TARBALL_HOST` | `files.example.org` | SSH host the tarballs are uploaded to | -| `TARBALL_PATH` | `/path/to/tarballs` | Directory on that host that the web server publishes | | `TARBALL_BASE_URL` | `https://asger.weirsoe.dk/tarballz` | Public URL the PKGBUILD downloads from | | `PUBLISH` | `true` | Master switch. Unless it is `true`, a run only builds and verifies, leaving the tarball in the `jasp-build` volume under `out/`: no upload, no `state.json` commit, no AUR push. | @@ -106,6 +104,8 @@ Set these in the Gitea repo before the first run. | Name | Meaning | | --- | --- | | `GH_TOKEN` | *Optional.* A GitHub PAT, passed to the build as `GITHUB_PAT`. Not used for publishing — several JASP R modules install from GitHub and anonymous API rate limits can fail the build. | +| `TARBALL_HOST` | SSH host the tarballs are uploaded to. A secret rather than a variable: run logs of a public repo are public, and Gitea prints variables in them. | +| `TARBALL_PATH` | Directory on that host that the web server publishes. A secret for the same reason. | | `TARBALL_SSH_KEY` | Private key authorised on `TARBALL_HOST` for uploading tarballs | | `AUR_SSH_PRIVATE_KEY` | Private SSH key registered with your AUR account. Copy the value already set on `agw/pi3-smart-workspace`. | | `STATE_PUSH_TOKEN` | Gitea token with write access to this repo, for committing `state.json`. (Gitea reserves the `GITEA_` secret prefix.) |