From 4964dda690a91751f369c6fcd66ca364bb34714b Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 23 Aug 2026 18:52:10 -0700 Subject: [PATCH 1/2] Rename PANGOLIN_ACCESS_TOKEN_ID/PANGOLIN_ACCESS_TOKEN to SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN The stored GitHub secret on staging is renamed (done live by the maintainer, same values), matching the hub task's own generic, auth-mechanism-agnostic interface, the same shape as the earlier SITE_BASE_URL rename. The deploy hook already bridges the hub's SITE_AUTH_TOKEN_ID/ SITE_AUTH_TOKEN into PANGOLIN_ACCESS_TOKEN_ID/PANGOLIN_ACCESS_TOKEN for check-live-urls.sh, so no hook change is needed. That script keeps its own Pangolin-specific naming, and the local secrets/*.env convention and example.env are unaffected. --- .github/workflows/deploy-site.yml | 9 ++++----- ENVIRONMENT.md | 4 ++-- TODO.md | 2 +- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/.github/workflows/deploy-site.yml b/.github/workflows/deploy-site.yml index a4a17d1..8e3fdfc 100644 --- a/.github/workflows/deploy-site.yml +++ b/.github/workflows/deploy-site.yml @@ -62,10 +62,9 @@ jobs: environment: ${{ inputs.environment }} permissions: contents: read - # Cross-repo, so secrets: inherit does not apply, and the names differ from what this repo stores. - # PANGOLIN_ACCESS_TOKEN_ID/PANGOLIN_ACCESS_TOKEN forward as the hub task's generic SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN. - # Production maps both to empty, since neither secret is set there, which the hub task's own assert step treats as a public site. + # Cross-repo, so secrets: inherit does not apply. + # Production maps both auth-token secrets to empty, since neither is set there, which the hub task's own assert step treats as a public site. secrets: DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }} - SITE_AUTH_TOKEN_ID: ${{ secrets.PANGOLIN_ACCESS_TOKEN_ID }} - SITE_AUTH_TOKEN: ${{ secrets.PANGOLIN_ACCESS_TOKEN }} + SITE_AUTH_TOKEN_ID: ${{ secrets.SITE_AUTH_TOKEN_ID }} + SITE_AUTH_TOKEN: ${{ secrets.SITE_AUTH_TOKEN }} diff --git a/ENVIRONMENT.md b/ENVIRONMENT.md index 473775c..c64cfcd 100644 --- a/ENVIRONMENT.md +++ b/ENVIRONMENT.md @@ -69,8 +69,8 @@ Held on the `production` and `staging` environments. The deploy workflow reads n | `DEPLOY_SSH_USER` | variable | the confined deploy account | | `DEPLOY_SSH_KNOWN_HOSTS` | variable | the pinned host key. A variable rather than a secret, deliberately, since it is public by nature | | `DEPLOY_SSH_PRIVATE_KEY` | secret | the deploy key, held behind an `rrsync` forced command | -| `PANGOLIN_ACCESS_TOKEN_ID` | secret | as above, for an environment behind the gate | -| `PANGOLIN_ACCESS_TOKEN` | secret | as above | +| `SITE_AUTH_TOKEN_ID` | secret | as above, for an environment behind the gate. `.github/actions/deploy/action.yml` reads it as `PANGOLIN_ACCESS_TOKEN_ID` for `check-live-urls.sh` | +| `SITE_AUTH_TOKEN` | secret | as above, bridged to `PANGOLIN_ACCESS_TOKEN` the same way | **`SITE_BASE_URL` being read twice is the trap worth knowing.** A wrong value bakes the wrong address into every canonical tag and then runs the full URL contract against that same wrong address, so the deploy verifies itself and passes. Its generic name is the hub's own `deploy-site-task.yml` interface, since that task is not Hugo-specific. Blog's own scripts and `OPERATIONS.md` keep reading `HUGO_BASEURL`, which the deploy hook bridges from `SITE_BASE_URL` in one place. diff --git a/TODO.md b/TODO.md index ebb4007..1a5d53b 100644 --- a/TODO.md +++ b/TODO.md @@ -195,7 +195,7 @@ Secrets and variables, per environment. The App-token pair is repository-scoped | `DEPLOY_SSH_PRIVATE_KEY` | secret | | `DEPLOY_SSH_HOST`, `DEPLOY_SSH_USER`, `DEPLOY_SSH_KNOWN_HOSTS` | variable | | `SITE_BASE_URL` | variable | -| `PANGOLIN_ACCESS_TOKEN_ID`, `PANGOLIN_ACCESS_TOKEN` | secret, staging only | +| `SITE_AUTH_TOKEN_ID`, `SITE_AUTH_TOKEN` | secret, staging only | | `CODEGEN_APP_CLIENT_ID`, `CODEGEN_APP_PRIVATE_KEY` | secret, both stores | `DEPLOY_SSH_PRIVATE_KEY` holds the same key in both environments, per the decision above. The environment split still carries the base URL, the SSH endpoint, and the staging-only token pair, so it is not decorative. From adb7214173554a18a5ee35102c9309609922b7a8 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 23 Aug 2026 19:07:47 -0700 Subject: [PATCH 2/2] Update spec/secrets.json for Both Rename Rounds environmentSecrets.staging still named PANGOLIN_ACCESS_TOKEN_ID/ PANGOLIN_ACCESS_TOKEN, and variables still named HUGO_BASEURL, neither updated when the live GitHub Environment values were renamed. Both are now SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN and SITE_BASE_URL, matching what AUDIT.md's manual secrets check actually reads against. --- spec/secrets.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/spec/secrets.json b/spec/secrets.json index 69d028c..0626156 100644 --- a/spec/secrets.json +++ b/spec/secrets.json @@ -30,13 +30,13 @@ "DEPLOY_SSH_HOST", "DEPLOY_SSH_USER", "DEPLOY_SSH_KNOWN_HOSTS", - "HUGO_BASEURL" + "SITE_BASE_URL" ], "secretsNote": "The 'secrets' and 'variables' lists are required in every environment named above. 'environmentSecrets' names what one environment carries and another does not, so a name audit does not read a staging-only credential as missing from production. Staging keeps its auth gate on and production answers unauthenticated, so the access token exists on staging alone and checks/check-live-urls.sh sends no credential where the pair is absent.", "environmentSecrets": { "staging": [ - "PANGOLIN_ACCESS_TOKEN_ID", - "PANGOLIN_ACCESS_TOKEN" + "SITE_AUTH_TOKEN_ID", + "SITE_AUTH_TOKEN" ], "production": [] },