Breadway/bread-ecosystem
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

ci: fail fast on missing signing key in dev/beta index regeneration
All checks were successful
dev bread-theme / build (push) Successful in 17s
Details
dev bakery / build (push) Successful in 48s
Details

Browse source 
Matches the same guard just added to bread's dev/beta workflows: a missing
BAKERY_MINISIGN_SEC_KEY_PATH secret should fail the job loudly rather than
silently publish an unsigned index.
This commit is contained in:
Breadway 2026-07-22 09:50:54 +08:00
parent 4ac54c610d
commit 86e712d726
4 changed files with 28 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
.forgejo/workflows/beta-bakery.yml
View file

@ -58,4 +58,10 @@ jobs:
env: env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }} MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
TRACK: beta TRACK: beta
run: cd src && bash scripts/gen-index.sh run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
exit 1
fi
cd src && bash scripts/gen-index.sh

8
.forgejo/workflows/beta-bread-theme.yml
View file

@ -53,4 +53,10 @@ jobs:
env: env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }} MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
TRACK: beta TRACK: beta
run: cd src && bash scripts/gen-index.sh run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
exit 1
fi
cd src && bash scripts/gen-index.sh

8
.forgejo/workflows/dev-bakery.yml
View file

@ -77,4 +77,10 @@ jobs:
env: env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }} MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
TRACK: dev TRACK: dev
run: cd src && bash scripts/gen-index.sh run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
exit 1
fi
cd src && bash scripts/gen-index.sh

8
.forgejo/workflows/dev-bread-theme.yml
View file

@ -66,4 +66,10 @@ jobs:
env: env:
MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }} MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
TRACK: dev TRACK: dev
run: cd src && bash scripts/gen-index.sh run: |
set -euo pipefail
if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
exit 1
fi
cd src && bash scripts/gen-index.sh