Proxmox/ProxmoxVE
1
0
Fork 1
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-09-01 11:03:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Rename CI credentials to org-wide names, demote non-secrets to variables (#16919)

Browse Source
This commit is contained in:
CanbiZ (MickLesk)
2026-08-31 18:35:56 +02:00
committed by GitHub
parent 28cfd73cc5
commit 8639310cfa
11 changed files with 41 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/auto-update-app-headers.yml
Generated
+4 -4
View File
@@ -24,15 +24,15 @@ jobs:
id: generate-token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
app-id: ${{ vars.GHAPP_HEADERS_ID }}
private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
- name: Generate a token for PR approval and merge
id: generate-token-merge
uses: actions/create-github-app-token@v3
with:
app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
app-id: ${{ vars.GHAPP_MERGEBOT_ID }}
private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }}
# Step 1: Checkout repository
- name: Checkout repository
.github/workflows/changelog-archive.yml
Generated
+4 -4
View File
@@ -21,15 +21,15 @@ jobs:
id: generate-token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
app-id: ${{ vars.GHAPP_HEADERS_ID }}
private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
- name: Generate a token for PR approval and merge
id: generate-token-merge
uses: actions/create-github-app-token@v3
with:
app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
app-id: ${{ vars.GHAPP_MERGEBOT_ID }}
private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }}
- name: Checkout code
uses: actions/checkout@v7
.github/workflows/changelog-pr.yml
Generated
+4 -4
View File
@@ -26,15 +26,15 @@ jobs:
id: generate-token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ vars.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
app-id: ${{ vars.GHAPP_HEADERS_ID }}
private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
- name: Generate a token for PR approval and merge
id: generate-token-merge
uses: actions/create-github-app-token@v3
with:
app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
app-id: ${{ vars.GHAPP_MERGEBOT_ID }}
private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }}
- name: Checkout code
uses: actions/checkout@v7
.github/workflows/close_issue_in_dev.yaml
Generated
+3 -3
View File
@@ -128,7 +128,7 @@ jobs:
if: steps.find_issue.outputs.issue_numbers != ''
shell: bash
env:
GH_TOKEN: ${{ secrets.PAT_MICHEL }}
GH_TOKEN: ${{ secrets.GH_CROSS_REPO_TOKEN }}
PR_NUMBER: ${{ github.event.pull_request.number }}
ISSUE_NUMBERS: ${{ steps.find_issue.outputs.issue_numbers }}
run: |
@@ -147,8 +147,8 @@ jobs:
- name: Set is_dev to false in PocketBase
if: steps.get_slugs.outputs.count != '0'
env:
POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
PR_URL: ${{ github.server_url }}/${{ github.repository }}/pull/${{ github.event.pull_request.number }}
.github/workflows/delete-pocketbase-entry-on-removal.yml
Generated
+4 -4
View File
@@ -75,8 +75,8 @@ jobs:
- name: Mark as deleted in PocketBase
if: steps.slugs.outputs.count != '0'
env:
POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
run: |
@@ -175,8 +175,8 @@ jobs:
- name: Generate CT stubs for deleted scripts
if: steps.slugs.outputs.count != '0'
env:
POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
run: |
.github/workflows/notify-breaking-change.yml
Generated
+2 -2
View File
@@ -33,8 +33,8 @@ jobs:
steps:
- name: Notify site of breaking change
env:
INGEST_SECRET: ${{ secrets.BREAKING_CHANGE_INGEST_SECRET }}
SITE_URL: ${{ secrets.FRONTEND_URL || vars.SITE_URL || 'https://community-scripts.org' }}
INGEST_SECRET: ${{ secrets.FRONTEND_ADVISORY_SECRET }}
SITE_URL: ${{ vars.FRONTEND_URL || 'https://community-scripts.org' }}
PR: ${{ github.event.pull_request.number }}
run: |
set -euo pipefail
.github/workflows/pocketbase-ai-bot.yml
Generated
+7 -7
View File
@@ -28,26 +28,26 @@ jobs:
id: app-token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ secrets.PB_BOT_APP_ID }}
private-key: ${{ secrets.PB_BOT_APP_PRIVATE_KEY }}
app-id: ${{ vars.GHAPP_PBBOT_ID }}
private-key: ${{ secrets.GHAPP_PBBOT_PRIVATE_KEY }}
- name: Run PocketBase AI bot
env:
# GitHub REST as the bot identity
GH_APP_TOKEN: ${{ steps.app-token.outputs.token }}
PB_BOT_APP_ID: ${{ secrets.PB_BOT_APP_ID }}
PB_BOT_APP_ID: ${{ vars.GHAPP_PBBOT_ID }}
# GitHub Models inference uses the built-in token (needs models: read)
MODELS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Built-in token for git/PR ops (CT-defaults sync), mirroring the slash bot
GH_DEFAULT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
AI_MODEL: openai/gpt-4o
# PocketBase
POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
FRONTEND_URL: ${{ secrets.FRONTEND_URL }}
REVALIDATE_SECRET: ${{ secrets.REVALIDATE_SECRET }}
FRONTEND_URL: ${{ vars.FRONTEND_URL }}
REVALIDATE_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
# Event context
COMMENT_BODY: ${{ github.event.comment.body }}
COMMENT_ID: ${{ github.event.comment.id }}
.github/workflows/pocketbase-bot.yml
Generated
+5 -5
View File
@@ -19,8 +19,8 @@ jobs:
steps:
- name: Execute PocketBase bot command
env:
POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
COMMENT_BODY: ${{ github.event.comment.body }}
@@ -31,12 +31,12 @@ jobs:
ACTOR: ${{ github.event.comment.user.login }}
ACTOR_ASSOCIATION: ${{ github.event.comment.author_association }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
FRONTEND_URL: ${{ secrets.FRONTEND_URL }}
REVALIDATE_SECRET: ${{ secrets.REVALIDATE_SECRET }}
FRONTEND_URL: ${{ vars.FRONTEND_URL }}
REVALIDATE_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
# Screenshot attaching is delegated to the frontend, which owns the
# fetching and validation. Without this the subcommand says so rather
# than failing halfway.
SCREENSHOT_IMPORT_SECRET: ${{ secrets.SCREENSHOT_IMPORT_SECRET }}
SCREENSHOT_IMPORT_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
run: |
node << 'ENDSCRIPT'
(async function () {
.github/workflows/push-json-to-pocketbase.yml
Generated
+2 -2
View File
@@ -37,8 +37,8 @@ jobs:
- name: Push to PocketBase
if: steps.changed.outputs.count != '0'
env:
POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
run: |
.github/workflows/sync-to-incus.yml
Generated
+4 -4
View File
@@ -10,8 +10,8 @@ name: Sync ct/install to Incus
# script. We therefore only fire a repository_dispatch and let that single
# source of truth do the work (and auto-approve + merge its own PR).
#
# Auth: the "push-app-to-main" GitHub App (vars.PUSH_MAIN_APP_ID /
# secrets.PUSH_MAIN_APP_SECRET), scoped to community-scripts/Incus. It has
# Auth: the "push-app-to-main" GitHub App (vars.GHAPP_SYNC_ID /
# secrets.GHAPP_SYNC_PRIVATE_KEY), scoped to community-scripts/Incus. It has
# contents:write, which repository_dispatch requires (community-scripts-pr-app
# only has pull_requests:write, so it cannot dispatch). The app must be
# installed on the Incus repo.
@@ -38,8 +38,8 @@ jobs:
id: token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ vars.PUSH_MAIN_APP_ID }}
private-key: ${{ secrets.PUSH_MAIN_APP_SECRET }}
app-id: ${{ vars.GHAPP_SYNC_ID }}
private-key: ${{ secrets.GHAPP_SYNC_PRIVATE_KEY }}
owner: community-scripts
repositories: Incus
.github/workflows/update-script-timestamp-on-sh-change.yml
Generated
+2 -2
View File
@@ -69,8 +69,8 @@ jobs:
- name: Update script timestamps in PocketBase
if: steps.slugs.outputs.count != '0'
env:
POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
COMMIT_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}