From ea798df13a4ec6c55f51aa041c0cda5f60dc5311 Mon Sep 17 00:00:00 2001 From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:30:11 +0200 Subject: [PATCH 1/7] yuvomi/aurral: bump NODE_VERSION per upstream requirements (#16913) (#16914) --- ct/aurral.sh | 1 + ct/karakeep.sh | 4 +++- ct/yuvomi.sh | 5 ++++- install/aurral-install.sh | 2 +- install/yuvomi-install.sh | 2 +- 5 files changed, 10 insertions(+), 4 deletions(-) diff --git a/ct/aurral.sh b/ct/aurral.sh index 98cef007b..516be89a6 100644 --- a/ct/aurral.sh +++ b/ct/aurral.sh @@ -38,6 +38,7 @@ function update_script() { msg_ok "Stopped Service" CLEAN_INSTALL=1 fetch_and_deploy_gh_release "aurral" "lklynet/aurral" "tarball" + NODE_VERSION="26" setup_nodejs msg_info "Updating Aurral" cd /opt/aurral diff --git a/ct/karakeep.sh b/ct/karakeep.sh index 560e564cd..04fde8a4e 100644 --- a/ct/karakeep.sh +++ b/ct/karakeep.sh @@ -1,5 +1,7 @@ #!/usr/bin/env bash -source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func) +_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main" +_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func" +source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func") # Copyright (c) 2021-2026 tteck # Author: MickLesk (Canbiz) & vhsdream # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE diff --git a/ct/yuvomi.sh b/ct/yuvomi.sh index 625a0aa61..a70140cc6 100644 --- a/ct/yuvomi.sh +++ b/ct/yuvomi.sh @@ -1,5 +1,7 @@ #!/usr/bin/env bash -source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func) +_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main" +_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func" +source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func") # Copyright (c) 2021-2026 community-scripts ORG # Author: MickLesk (CanbiZ) # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE @@ -38,6 +40,7 @@ function update_script() { create_backup /opt/yuvomi/data /opt/yuvomi/.env CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball" + NODE_VERSION="24" setup_nodejs msg_info "Installing Node.js Dependencies" cd /opt/yuvomi diff --git a/install/aurral-install.sh b/install/aurral-install.sh index 3344f9ada..6db979dbc 100644 --- a/install/aurral-install.sh +++ b/install/aurral-install.sh @@ -22,7 +22,7 @@ $STD apt install -y \ fonts-dejavu-core msg_ok "Installed Dependencies" -NODE_VERSION="22" setup_nodejs +NODE_VERSION="26" setup_nodejs fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "yt-dlp" fetch_and_deploy_gh_release "aurral" "lklynet/aurral" "tarball" diff --git a/install/yuvomi-install.sh b/install/yuvomi-install.sh index 521049586..7f18767e8 100644 --- a/install/yuvomi-install.sh +++ b/install/yuvomi-install.sh @@ -21,7 +21,7 @@ $STD apt install -y \ libsqlcipher-dev msg_ok "Installed Dependencies" -NODE_VERSION="22" setup_nodejs +NODE_VERSION="24" setup_nodejs fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball" From 9b4121b8af487b121eb18ff7c449b6c898b53e63 Mon Sep 17 00:00:00 2001 From: "community-scripts-pr-app[bot]" <189241966+community-scripts-pr-app[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 14:30:36 +0000 Subject: [PATCH 2/7] Update CHANGELOG.md (#16920) Co-authored-by: github-actions[bot] --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c19874e61..902158cac 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -538,6 +538,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit ### 🚀 Updated Scripts + - yuvomi/aurral: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16914](https://github.com/community-scripts/ProxmoxVE/pull/16914)) + - #### 🐞 Bug Fixes - bambuddy: force asyncio loop, uvloop breaks camera proxy handlers [@MickLesk](https://github.com/MickLesk) ([#16904](https://github.com/community-scripts/ProxmoxVE/pull/16904)) From 82dc3a6dec8d285bcb4984e547f75a15d406f7f7 Mon Sep 17 00:00:00 2001 From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com> Date: Mon, 31 Aug 2026 16:30:47 +0200 Subject: [PATCH 3/7] vaultwarden: relax cargo release profile via env vars to avoid build OOM (#16915) --- ct/vaultwarden.sh | 2 +- install/vaultwarden-install.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ct/vaultwarden.sh b/ct/vaultwarden.sh index 2c1f9e787..69c9a50a2 100644 --- a/ct/vaultwarden.sh +++ b/ct/vaultwarden.sh @@ -64,7 +64,7 @@ update_deb_based() { cd /tmp/vaultwarden-src VW_VERSION="$VAULT" export VW_VERSION - $STD cargo build --features "sqlite,mysql,postgresql" --release + CARGO_BUILD_JOBS="$(get_parallel_jobs)" CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 $STD cargo build --features "sqlite,mysql,postgresql" --release if [[ -f /usr/bin/vaultwarden ]]; then cp target/release/vaultwarden /usr/bin/ else diff --git a/install/vaultwarden-install.sh b/install/vaultwarden-install.sh index 92946acea..026fdecdf 100644 --- a/install/vaultwarden-install.sh +++ b/install/vaultwarden-install.sh @@ -32,7 +32,7 @@ setup_deb_based() { cd /tmp/vaultwarden-src VW_VERSION=$(get_latest_github_release "dani-garcia/vaultwarden") export VW_VERSION - $STD cargo build --features "sqlite,mysql,postgresql" --release + CARGO_BUILD_JOBS="$(get_parallel_jobs)" CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 $STD cargo build --features "sqlite,mysql,postgresql" --release msg_ok "Built Vaultwarden" msg_info "Setting up Vaultwarden" From 28cfd73cc5784bd5ddb6e5cd9c49a0e9d4ba50dc Mon Sep 17 00:00:00 2001 From: "community-scripts-pr-app[bot]" <189241966+community-scripts-pr-app[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 14:31:04 +0000 Subject: [PATCH 4/7] Update CHANGELOG.md (#16921) Co-authored-by: github-actions[bot] --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 902158cac..27e6ee306 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -553,6 +553,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit - #### 🔧 Refactor + - vaultwarden: relax cargo release profile via env vars to avoid build OOM [@MickLesk](https://github.com/MickLesk) ([#16915](https://github.com/community-scripts/ProxmoxVE/pull/16915)) - kima-hub/maintainerr/planka/spliit: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16905](https://github.com/community-scripts/ProxmoxVE/pull/16905)) - gatus: pin Go toolchain to gatus's own go.mod version [@MickLesk](https://github.com/MickLesk) ([#16893](https://github.com/community-scripts/ProxmoxVE/pull/16893)) - immich: tolerate enable-maintenance-mode crash, same as disable-maintenance-mode [@MickLesk](https://github.com/MickLesk) ([#16866](https://github.com/community-scripts/ProxmoxVE/pull/16866)) From 8639310cfa385eaf46f669922387fde0d20bcc0b Mon Sep 17 00:00:00 2001 From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com> Date: Mon, 31 Aug 2026 18:35:56 +0200 Subject: [PATCH 5/7] Rename CI credentials to org-wide names, demote non-secrets to variables (#16919) --- .github/workflows/auto-update-app-headers.yml | 8 ++++---- .github/workflows/changelog-archive.yml | 8 ++++---- .github/workflows/changelog-pr.yml | 8 ++++---- .github/workflows/close_issue_in_dev.yaml | 6 +++--- .../delete-pocketbase-entry-on-removal.yml | 8 ++++---- .github/workflows/notify-breaking-change.yml | 4 ++-- .github/workflows/pocketbase-ai-bot.yml | 14 +++++++------- .github/workflows/pocketbase-bot.yml | 10 +++++----- .github/workflows/push-json-to-pocketbase.yml | 4 ++-- .github/workflows/sync-to-incus.yml | 8 ++++---- .../update-script-timestamp-on-sh-change.yml | 4 ++-- 11 files changed, 41 insertions(+), 41 deletions(-) diff --git a/.github/workflows/auto-update-app-headers.yml b/.github/workflows/auto-update-app-headers.yml index 386a6477a..58d3306c0 100644 --- a/.github/workflows/auto-update-app-headers.yml +++ b/.github/workflows/auto-update-app-headers.yml @@ -24,15 +24,15 @@ jobs: id: generate-token uses: actions/create-github-app-token@v3 with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} + app-id: ${{ vars.GHAPP_HEADERS_ID }} + private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }} - name: Generate a token for PR approval and merge id: generate-token-merge uses: actions/create-github-app-token@v3 with: - app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }} - private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }} + app-id: ${{ vars.GHAPP_MERGEBOT_ID }} + private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }} # Step 1: Checkout repository - name: Checkout repository diff --git a/.github/workflows/changelog-archive.yml b/.github/workflows/changelog-archive.yml index 2df3ca0c6..7e53f218f 100644 --- a/.github/workflows/changelog-archive.yml +++ b/.github/workflows/changelog-archive.yml @@ -21,15 +21,15 @@ jobs: id: generate-token uses: actions/create-github-app-token@v3 with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} + app-id: ${{ vars.GHAPP_HEADERS_ID }} + private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }} - name: Generate a token for PR approval and merge id: generate-token-merge uses: actions/create-github-app-token@v3 with: - app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }} - private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }} + app-id: ${{ vars.GHAPP_MERGEBOT_ID }} + private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }} - name: Checkout code uses: actions/checkout@v7 diff --git a/.github/workflows/changelog-pr.yml b/.github/workflows/changelog-pr.yml index e1f050784..76fb2629b 100644 --- a/.github/workflows/changelog-pr.yml +++ b/.github/workflows/changelog-pr.yml @@ -26,15 +26,15 @@ jobs: id: generate-token uses: actions/create-github-app-token@v3 with: - app-id: ${{ vars.APP_ID }} - private-key: ${{ secrets.APP_PRIVATE_KEY }} + app-id: ${{ vars.GHAPP_HEADERS_ID }} + private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }} - name: Generate a token for PR approval and merge id: generate-token-merge uses: actions/create-github-app-token@v3 with: - app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }} - private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }} + app-id: ${{ vars.GHAPP_MERGEBOT_ID }} + private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }} - name: Checkout code uses: actions/checkout@v7 diff --git a/.github/workflows/close_issue_in_dev.yaml b/.github/workflows/close_issue_in_dev.yaml index a8efe4281..14eb49a1c 100644 --- a/.github/workflows/close_issue_in_dev.yaml +++ b/.github/workflows/close_issue_in_dev.yaml @@ -128,7 +128,7 @@ jobs: if: steps.find_issue.outputs.issue_numbers != '' shell: bash env: - GH_TOKEN: ${{ secrets.PAT_MICHEL }} + GH_TOKEN: ${{ secrets.GH_CROSS_REPO_TOKEN }} PR_NUMBER: ${{ github.event.pull_request.number }} ISSUE_NUMBERS: ${{ steps.find_issue.outputs.issue_numbers }} run: | @@ -147,8 +147,8 @@ jobs: - name: Set is_dev to false in PocketBase if: steps.get_slugs.outputs.count != '0' env: - POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }} - POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }} + POCKETBASE_URL: ${{ vars.POCKETBASE_URL }} + POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }} POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }} POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }} PR_URL: ${{ github.server_url }}/${{ github.repository }}/pull/${{ github.event.pull_request.number }} diff --git a/.github/workflows/delete-pocketbase-entry-on-removal.yml b/.github/workflows/delete-pocketbase-entry-on-removal.yml index f8027738d..f3d42d104 100644 --- a/.github/workflows/delete-pocketbase-entry-on-removal.yml +++ b/.github/workflows/delete-pocketbase-entry-on-removal.yml @@ -75,8 +75,8 @@ jobs: - name: Mark as deleted in PocketBase if: steps.slugs.outputs.count != '0' env: - POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }} - POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }} + POCKETBASE_URL: ${{ vars.POCKETBASE_URL }} + POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }} POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }} POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }} run: | @@ -175,8 +175,8 @@ jobs: - name: Generate CT stubs for deleted scripts if: steps.slugs.outputs.count != '0' env: - POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }} - POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }} + POCKETBASE_URL: ${{ vars.POCKETBASE_URL }} + POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }} POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }} POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }} run: | diff --git a/.github/workflows/notify-breaking-change.yml b/.github/workflows/notify-breaking-change.yml index d00cd2bc0..a3f219f48 100644 --- a/.github/workflows/notify-breaking-change.yml +++ b/.github/workflows/notify-breaking-change.yml @@ -33,8 +33,8 @@ jobs: steps: - name: Notify site of breaking change env: - INGEST_SECRET: ${{ secrets.BREAKING_CHANGE_INGEST_SECRET }} - SITE_URL: ${{ secrets.FRONTEND_URL || vars.SITE_URL || 'https://community-scripts.org' }} + INGEST_SECRET: ${{ secrets.FRONTEND_ADVISORY_SECRET }} + SITE_URL: ${{ vars.FRONTEND_URL || 'https://community-scripts.org' }} PR: ${{ github.event.pull_request.number }} run: | set -euo pipefail diff --git a/.github/workflows/pocketbase-ai-bot.yml b/.github/workflows/pocketbase-ai-bot.yml index 5ee005c6f..eb0622ef0 100644 --- a/.github/workflows/pocketbase-ai-bot.yml +++ b/.github/workflows/pocketbase-ai-bot.yml @@ -28,26 +28,26 @@ jobs: id: app-token uses: actions/create-github-app-token@v3 with: - app-id: ${{ secrets.PB_BOT_APP_ID }} - private-key: ${{ secrets.PB_BOT_APP_PRIVATE_KEY }} + app-id: ${{ vars.GHAPP_PBBOT_ID }} + private-key: ${{ secrets.GHAPP_PBBOT_PRIVATE_KEY }} - name: Run PocketBase AI bot env: # GitHub REST as the bot identity GH_APP_TOKEN: ${{ steps.app-token.outputs.token }} - PB_BOT_APP_ID: ${{ secrets.PB_BOT_APP_ID }} + PB_BOT_APP_ID: ${{ vars.GHAPP_PBBOT_ID }} # GitHub Models inference uses the built-in token (needs models: read) MODELS_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Built-in token for git/PR ops (CT-defaults sync), mirroring the slash bot GH_DEFAULT_TOKEN: ${{ secrets.GITHUB_TOKEN }} AI_MODEL: openai/gpt-4o # PocketBase - POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }} - POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }} + POCKETBASE_URL: ${{ vars.POCKETBASE_URL }} + POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }} POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }} POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }} - FRONTEND_URL: ${{ secrets.FRONTEND_URL }} - REVALIDATE_SECRET: ${{ secrets.REVALIDATE_SECRET }} + FRONTEND_URL: ${{ vars.FRONTEND_URL }} + REVALIDATE_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }} # Event context COMMENT_BODY: ${{ github.event.comment.body }} COMMENT_ID: ${{ github.event.comment.id }} diff --git a/.github/workflows/pocketbase-bot.yml b/.github/workflows/pocketbase-bot.yml index 46d056d4d..07aa56262 100644 --- a/.github/workflows/pocketbase-bot.yml +++ b/.github/workflows/pocketbase-bot.yml @@ -19,8 +19,8 @@ jobs: steps: - name: Execute PocketBase bot command env: - POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }} - POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }} + POCKETBASE_URL: ${{ vars.POCKETBASE_URL }} + POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }} POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }} POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }} COMMENT_BODY: ${{ github.event.comment.body }} @@ -31,12 +31,12 @@ jobs: ACTOR: ${{ github.event.comment.user.login }} ACTOR_ASSOCIATION: ${{ github.event.comment.author_association }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - FRONTEND_URL: ${{ secrets.FRONTEND_URL }} - REVALIDATE_SECRET: ${{ secrets.REVALIDATE_SECRET }} + FRONTEND_URL: ${{ vars.FRONTEND_URL }} + REVALIDATE_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }} # Screenshot attaching is delegated to the frontend, which owns the # fetching and validation. Without this the subcommand says so rather # than failing halfway. - SCREENSHOT_IMPORT_SECRET: ${{ secrets.SCREENSHOT_IMPORT_SECRET }} + SCREENSHOT_IMPORT_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }} run: | node << 'ENDSCRIPT' (async function () { diff --git a/.github/workflows/push-json-to-pocketbase.yml b/.github/workflows/push-json-to-pocketbase.yml index 23d0f4f2e..77ca03b2a 100644 --- a/.github/workflows/push-json-to-pocketbase.yml +++ b/.github/workflows/push-json-to-pocketbase.yml @@ -37,8 +37,8 @@ jobs: - name: Push to PocketBase if: steps.changed.outputs.count != '0' env: - POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }} - POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }} + POCKETBASE_URL: ${{ vars.POCKETBASE_URL }} + POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }} POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }} POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }} run: | diff --git a/.github/workflows/sync-to-incus.yml b/.github/workflows/sync-to-incus.yml index cb8e932df..3565b34fb 100644 --- a/.github/workflows/sync-to-incus.yml +++ b/.github/workflows/sync-to-incus.yml @@ -10,8 +10,8 @@ name: Sync ct/install to Incus # script. We therefore only fire a repository_dispatch and let that single # source of truth do the work (and auto-approve + merge its own PR). # -# Auth: the "push-app-to-main" GitHub App (vars.PUSH_MAIN_APP_ID / -# secrets.PUSH_MAIN_APP_SECRET), scoped to community-scripts/Incus. It has +# Auth: the "push-app-to-main" GitHub App (vars.GHAPP_SYNC_ID / +# secrets.GHAPP_SYNC_PRIVATE_KEY), scoped to community-scripts/Incus. It has # contents:write, which repository_dispatch requires (community-scripts-pr-app # only has pull_requests:write, so it cannot dispatch). The app must be # installed on the Incus repo. @@ -38,8 +38,8 @@ jobs: id: token uses: actions/create-github-app-token@v3 with: - app-id: ${{ vars.PUSH_MAIN_APP_ID }} - private-key: ${{ secrets.PUSH_MAIN_APP_SECRET }} + app-id: ${{ vars.GHAPP_SYNC_ID }} + private-key: ${{ secrets.GHAPP_SYNC_PRIVATE_KEY }} owner: community-scripts repositories: Incus diff --git a/.github/workflows/update-script-timestamp-on-sh-change.yml b/.github/workflows/update-script-timestamp-on-sh-change.yml index f2f271845..ad7b18e5d 100644 --- a/.github/workflows/update-script-timestamp-on-sh-change.yml +++ b/.github/workflows/update-script-timestamp-on-sh-change.yml @@ -69,8 +69,8 @@ jobs: - name: Update script timestamps in PocketBase if: steps.slugs.outputs.count != '0' env: - POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }} - POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }} + POCKETBASE_URL: ${{ vars.POCKETBASE_URL }} + POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }} POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }} POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }} COMMIT_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }} From 6a5a714d1877b5d845dd3a0e78aaedfd817be40d Mon Sep 17 00:00:00 2001 From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com> Date: Mon, 31 Aug 2026 18:36:40 +0200 Subject: [PATCH 6/7] openwebui: add UV_HTTP_TIMEOUT and retry loop to prevent uv install hangs (#16917) --- ct/openwebui.sh | 12 ++++++++++-- install/openwebui-install.sh | 6 +++++- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/ct/openwebui.sh b/ct/openwebui.sh index a418024aa..e89b242ae 100644 --- a/ct/openwebui.sh +++ b/ct/openwebui.sh @@ -50,7 +50,11 @@ function update_script() { msg_info "Installing uv-based Open-WebUI" PYTHON_VERSION="3.12" setup_uv - $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] + export UV_HTTP_TIMEOUT=300 + for attempt in $(seq 1 3); do + $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] && break + [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10 + done msg_ok "Installed uv-based Open-WebUI" msg_info "Restoring data" @@ -123,7 +127,11 @@ EOF OTEL_ARGS+=(--with "$pkg") done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1) fi - $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] + export UV_HTTP_TIMEOUT=300 + for attempt in $(seq 1 3); do + $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break + [[ $attempt -lt 3 ]] && msg_warn "Open WebUI update attempt $attempt failed, retrying..." && sleep 10 + done systemctl restart open-webui msg_ok "Updated Open WebUI" msg_ok "Updated successfully!" diff --git a/install/openwebui-install.sh b/install/openwebui-install.sh index 00a24dc5a..13234820d 100644 --- a/install/openwebui-install.sh +++ b/install/openwebui-install.sh @@ -46,7 +46,11 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then fi msg_info "Installing Open WebUI" -$STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] +export UV_HTTP_TIMEOUT=300 +for attempt in $(seq 1 3); do + $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break + [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10 +done msg_ok "Installed Open WebUI" read -r -p "${TAB3}Would you like to add Ollama? " prompt From 3bb92c5a5438d522c2bb10260bdc6d7cf6deb82c Mon Sep 17 00:00:00 2001 From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com> Date: Mon, 31 Aug 2026 18:37:10 +0200 Subject: [PATCH 7/7] omv: migrate to new package repo host (packages.openmediavault.org is dead) (#16918) --- ct/omv.sh | 12 +++++++++++- install/omv-install.sh | 4 ++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/ct/omv.sh b/ct/omv.sh index d8f04a747..746222042 100644 --- a/ct/omv.sh +++ b/ct/omv.sh @@ -1,5 +1,7 @@ #!/usr/bin/env bash -source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func) +_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main" +_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func" +source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func") # Copyright (c) 2021-2026 tteck # Author: tteck (tteckster) # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE @@ -28,6 +30,14 @@ function update_script() { msg_error "No ${APP} Installation Found!" exit fi + + if grep -q "packages.openmediavault.org" /etc/apt/sources.list.d/openmediavault.list; then + msg_info "Migrating OpenMediaVault package repository" + curl -fsSL "https://openmediavault.github.io/packages/archive.key" | gpg --dearmor >"/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg" + sed -i 's#https\?://packages.openmediavault.org/public#https://openmediavault.github.io/packages#' /etc/apt/sources.list.d/openmediavault.list + msg_ok "Migrated OpenMediaVault package repository" + fi + msg_info "Updating ${APP} LXC" $STD apt update $STD apt -y upgrade diff --git a/install/omv-install.sh b/install/omv-install.sh index 46e274d0a..427334463 100644 --- a/install/omv-install.sh +++ b/install/omv-install.sh @@ -14,9 +14,9 @@ network_check update_os msg_info "Installing OpenMediaVault (Patience)" -curl -fsSL "https://packages.openmediavault.org/public/archive.key" | gpg --dearmor >"/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg" +curl -fsSL "https://openmediavault.github.io/packages/archive.key" | gpg --dearmor >"/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg" cat </etc/apt/sources.list.d/openmediavault.list -deb [signed-by=/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg] http://packages.openmediavault.org/public sandworm main +deb [signed-by=/etc/apt/trusted.gpg.d/openmediavault-archive-keyring.gpg] https://openmediavault.github.io/packages sandworm main EOF export LANG=C.UTF-8