agw/pw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Read the deploy host and path from secrets, not variables
Build & Deploy / deploy (push) Successful in 4m14s
Details

Browse Source 
Run logs of a public repository are public, and Gitea prints variables in
them in clear text; only secrets are masked. The previous commit moved the
host into a variable and so still published it, in the deploy log.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
This commit is contained in:
Asger Geel Weirsøe
2026-10-01 17:40:00 +02:00
parent 2fcb4cdfa7
commit 32b85cc973
1 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yml
+7 -6
View File
@@ -40,18 +40,19 @@ jobs:
# tar over SSH (the runner image has no rsync). Build is unpacked into
# a .new dir on the web host and atomically swapped in, so the live web
# root is never left half-written. Host, user and path are repository
# variables, so no infrastructure details live in the public repo.
# root is never left half-written. Host and path are repository secrets,
# not variables: run logs of a public repo are public, and Gitea prints
# variables in them but masks secrets.
- name: Deploy dist/ over SSH
env:
DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
DEPLOY_USER: ${{ vars.DEPLOY_USER }}
DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
run: |
set -euo pipefail
: "${DEPLOY_HOST:?repository variable DEPLOY_HOST is not set}"
: "${DEPLOY_HOST:?repository secret DEPLOY_HOST is not set}"
: "${DEPLOY_USER:?repository variable DEPLOY_USER is not set}"
: "${DEPLOY_PATH:?repository variable DEPLOY_PATH is not set}"
: "${DEPLOY_PATH:?repository secret DEPLOY_PATH is not set}"
mkdir -p ~/.ssh
echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
chmod 600 ~/.ssh/deploy_key