agw/jasp-desktop-bin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Read the tarball host and path from secrets, not variables

Browse Source 
Run logs of a public repository are public, and Gitea prints variables in
them in clear text; only secrets are masked. They are now set only on the
publish step, the one step that needs them.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
This commit is contained in:
agw
2026-10-01 17:48:00 +02:00
parent aa08dc108e
commit 9670afa6d4
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -2
View File
@@ -96,8 +96,6 @@ Set these in the Gitea repo before the first run.
| Name | Example | Meaning |
| --- | --- | --- |
| `AUR_MAINTAINER` | `Asger Geel Weirsoe <asger at weircon dot dk>` | Written into the PKGBUILD header. The guidelines suggest obfuscating the address against spam harvesting. |
| `TARBALL_HOST` | `files.example.org` | SSH host the tarballs are uploaded to |
| `TARBALL_PATH` | `/path/to/tarballs` | Directory on that host that the web server publishes |
| `TARBALL_BASE_URL` | `https://asger.weirsoe.dk/tarballz` | Public URL the PKGBUILD downloads from |
| `PUBLISH` | `true` | Master switch. Unless it is `true`, a run only builds and verifies, leaving the tarball in the `jasp-build` volume under `out/`: no upload, no `state.json` commit, no AUR push. |
@@ -106,6 +104,8 @@ Set these in the Gitea repo before the first run.
| Name | Meaning |
| --- | --- |
| `GH_TOKEN` | *Optional.* A GitHub PAT, passed to the build as `GITHUB_PAT`. Not used for publishing — several JASP R modules install from GitHub and anonymous API rate limits can fail the build. |
| `TARBALL_HOST` | SSH host the tarballs are uploaded to. A secret rather than a variable: run logs of a public repo are public, and Gitea prints variables in them. |
| `TARBALL_PATH` | Directory on that host that the web server publishes. A secret for the same reason. |
| `TARBALL_SSH_KEY` | Private key authorised on `TARBALL_HOST` for uploading tarballs |
| `AUR_SSH_PRIVATE_KEY` | Private SSH key registered with your AUR account. Copy the value already set on `agw/pi3-smart-workspace`. |
| `STATE_PUSH_TOKEN` | Gitea token with write access to this repo, for committing `state.json`. (Gitea reserves the `GITEA_` secret prefix.) |