From 32b85cc9739d55b62bb0290563b4e268d926dc0b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Asger=20Geel=20Weirs=C3=B8e?= Date: Thu, 1 Oct 2026 17:40:00 +0200 Subject: [PATCH] Read the deploy host and path from secrets, not variables Run logs of a public repository are public, and Gitea prints variables in them in clear text; only secrets are masked. The previous commit moved the host into a variable and so still published it, in the deploy log. Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9 --- .gitea/workflows/deploy.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 7a08ddc..4cfd98c 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -40,18 +40,19 @@ jobs: # tar over SSH (the runner image has no rsync). Build is unpacked into # a .new dir on the web host and atomically swapped in, so the live web - # root is never left half-written. Host, user and path are repository - # variables, so no infrastructure details live in the public repo. + # root is never left half-written. Host and path are repository secrets, + # not variables: run logs of a public repo are public, and Gitea prints + # variables in them but masks secrets. - name: Deploy dist/ over SSH env: - DEPLOY_HOST: ${{ vars.DEPLOY_HOST }} + DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} DEPLOY_USER: ${{ vars.DEPLOY_USER }} - DEPLOY_PATH: ${{ vars.DEPLOY_PATH }} + DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }} run: | set -euo pipefail - : "${DEPLOY_HOST:?repository variable DEPLOY_HOST is not set}" + : "${DEPLOY_HOST:?repository secret DEPLOY_HOST is not set}" : "${DEPLOY_USER:?repository variable DEPLOY_USER is not set}" - : "${DEPLOY_PATH:?repository variable DEPLOY_PATH is not set}" + : "${DEPLOY_PATH:?repository secret DEPLOY_PATH is not set}" mkdir -p ~/.ssh echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key