From 4338c8c034ab66d93b84ff98c15a385b622fae88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Asger=20Weirs=C3=B8e?= <github@weircon.dk>
Date: Thu, 1 Oct 2026 17:46:00 +0200
Subject: [PATCH] Read the tarball host from a secret, not a variable

Run logs of a public repository are public, and Gitea prints variables in
them in clear text; only secrets are masked.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
---
 .gitea/workflows/aur-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/aur-publish.yml b/.gitea/workflows/aur-publish.yml
index 105a7be..35925a6 100644
--- a/.gitea/workflows/aur-publish.yml
+++ b/.gitea/workflows/aur-publish.yml
@@ -111,4 +111,4 @@ jobs:
           printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
           chmod 600 ~/.ssh/tarballz
           ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            "${{ vars.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD
+            "${{ secrets.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD