disong/baron_qa_write
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): isolate staging Actions settings under STG prefix

Browse Source 
Map staging Secrets and Variables exclusively from STG names, validate explicit API and SSO settings, and pass them to the staging Worker. Preserve production settings and document the variable registration and Secret migration.

Validation: source checks and 113 tests pass. Gitea STG Variables were created and verified; Secret registration remains with the user.
This commit is contained in:
root committed 2026-11-11 10:32:46 +09:00
1 parent 319a8afaab
commit 0d9b1fd703
5 files changed
+176 -36
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitea/workflows/deploy.yml
+20 -14
View File
@@ -10,17 +10,22 @@ jobs:
deploy:
runs-on: ubuntu-latest
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
ABC_API_KEY: ${{ secrets.ABC_API_KEY }}
ORG_CONTEXT_ENABLED: ${{ vars.STAGING_ORG_CONTEXT_ENABLED }}
ORG_CONTEXT_API_URL: ${{ vars.STAGING_ORG_CONTEXT_API_URL }}
ORG_CONTEXT_SCOPE_MODE: ${{ vars.STAGING_ORG_CONTEXT_SCOPE_MODE }}
ORG_CONTEXT_EXPOSURE: ${{ vars.STAGING_ORG_CONTEXT_EXPOSURE }}
ORG_CONTEXT_TENANT_IDS: ${{ vars.STAGING_ORG_CONTEXT_TENANT_IDS }}
ORG_CONTEXT_CACHE_TTL_SECONDS: ${{ vars.STAGING_ORG_CONTEXT_CACHE_TTL_SECONDS }}
ORG_CONTEXT_KEY_ID: ${{ secrets.STAGING_ORG_CONTEXT_KEY_ID }}
ORG_CONTEXT_KEY_SECRET: ${{ secrets.STAGING_ORG_CONTEXT_KEY_SECRET }}
CLOUDFLARE_API_TOKEN: ${{ secrets.STG_CLOUDFLARE_API_TOKEN }}
SESSION_SECRET: ${{ secrets.STG_SESSION_SECRET }}
ABC_API_KEY: ${{ secrets.STG_ABC_API_KEY }}
AUTH_CLIENT_ID: ${{ vars.STG_AUTH_CLIENT_ID }}
AUTH_ISSUER: ${{ vars.STG_AUTH_ISSUER }}
ABC_API_BASE_URL: ${{ vars.STG_ABC_API_BASE_URL }}
ABC_PROJECT_ID: ${{ vars.STG_ABC_PROJECT_ID }}
ABC_CHANNEL_ID: ${{ vars.STG_ABC_CHANNEL_ID }}
ORG_CONTEXT_ENABLED: ${{ vars.STG_ORG_CONTEXT_ENABLED }}
ORG_CONTEXT_API_URL: ${{ vars.STG_ORG_CONTEXT_API_URL }}
ORG_CONTEXT_SCOPE_MODE: ${{ vars.STG_ORG_CONTEXT_SCOPE_MODE }}
ORG_CONTEXT_EXPOSURE: ${{ vars.STG_ORG_CONTEXT_EXPOSURE }}
ORG_CONTEXT_TENANT_IDS: ${{ vars.STG_ORG_CONTEXT_TENANT_IDS }}
ORG_CONTEXT_CACHE_TTL_SECONDS: ${{ vars.STG_ORG_CONTEXT_CACHE_TTL_SECONDS }}
ORG_CONTEXT_KEY_ID: ${{ secrets.STG_ORG_CONTEXT_KEY_ID }}
ORG_CONTEXT_KEY_SECRET: ${{ secrets.STG_ORG_CONTEXT_KEY_SECRET }}
steps:
- name: Checkout
@@ -35,9 +40,10 @@ jobs:
shell: bash
run: |
set -euo pipefail
test -n "$CLOUDFLARE_API_TOKEN" || { echo "CLOUDFLARE_API_TOKEN is missing"; exit 1; }
test -n "$SESSION_SECRET" || { echo "SESSION_SECRET is missing"; exit 1; }
test -n "$ABC_API_KEY" || { echo "ABC_API_KEY is missing"; exit 1; }
test -n "$CLOUDFLARE_API_TOKEN" || { echo "STG_CLOUDFLARE_API_TOKEN is missing"; exit 1; }
test -n "$SESSION_SECRET" || { echo "STG_SESSION_SECRET is missing"; exit 1; }
test -n "$ABC_API_KEY" || { echo "STG_ABC_API_KEY is missing"; exit 1; }
node scripts/deploy-worker.mjs --validate-only
- name: Install dependencies
run: npm ci --no-fund --no-audit