From 5336d9537af9ae93f2b4290f2d2640663d3a6162 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 23 Aug 2026 20:41:00 -0700 Subject: [PATCH] Harden the Verify Step Against Unset Auth Tokens The verify step runs under set -u and expanded $SITE_AUTH_TOKEN_ID/ $SITE_AUTH_TOKEN directly. GitHub Actions' env: block always defines a mapped key, even empty, so the hub task's own unconditional env mapping should already make this safe on production. Safe expansion removes the doubt regardless, at no cost, right before this path's first production dispatch. --- .github/actions/deploy/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/deploy/action.yml b/.github/actions/deploy/action.yml index 8f09acd..04ba9d4 100644 --- a/.github/actions/deploy/action.yml +++ b/.github/actions/deploy/action.yml @@ -97,5 +97,5 @@ runs: EXPECT_RELEASE: ${{ inputs.release-id }} run: | set -Eeuo pipefail - PANGOLIN_ACCESS_TOKEN_ID="$SITE_AUTH_TOKEN_ID" PANGOLIN_ACCESS_TOKEN="$SITE_AUTH_TOKEN" \ + PANGOLIN_ACCESS_TOKEN_ID="${SITE_AUTH_TOKEN_ID:-}" PANGOLIN_ACCESS_TOKEN="${SITE_AUTH_TOKEN:-}" \ checks/check-live-urls.sh "$SITE_BASE_URL"