every-channel/every.channel
1
0
Fork 0
Code Releases Activity Actions

Guard Forgejo age secret setter
Some checks failed
deploy-cloudflare / checks (push) Successful in 1m46s
Details
deploy-cloudflare/breadcrumb bootstrap ok
deploy-cloudflare / deploy (push) Failing after 24s
Details
ci-gates / checks (push) Successful in 6m22s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-10 04:33:44 -07:00
parent d0a2cea40e
commit 1b2f1f7258
2 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/fj-set-age-key-secret.sh
View file

@ -8,6 +8,20 @@ host="${EVERY_CHANNEL_FORGE_HOST:-https://git.every.channel}"
repo="${EVERY_CHANNEL_FORGE_REPO:-every-channel/every.channel}"
secret_name="${EVERY_CHANNEL_FORGE_AGE_SECRET_NAME:-AGE_FORGE_SSH_KEY}"
key_path="${1:-$HOME/.config/every.channel/keys/founder_ed25519}"
confirm="${EVERY_CHANNEL_CONFIRM_DEDICATED_CI_KEY:-}"
if [[ "${confirm}" != "I_UNDERSTAND_THIS_IS_A_DEDICATED_CI_KEY" ]]; then
echo "error: refusing to set ${secret_name} without explicit dedicated-CI-key confirmation" >&2
echo "set EVERY_CHANNEL_CONFIRM_DEDICATED_CI_KEY=I_UNDERSTAND_THIS_IS_A_DEDICATED_CI_KEY only for a non-personal CI decrypt key" >&2
echo "preferred path: set CLOUDFLARE_API_TOKEN with scripts/fj-set-cloudflare-token-secret.sh" >&2
exit 2
fi
if [[ "${key_path}" == "$HOME/.ssh/id_ed25519" || "${key_path}" == "${HOME}/.ssh/id_ed25519" ]]; then
echo "error: refusing to upload personal key path ${key_path}" >&2
echo "use a scoped CLOUDFLARE_API_TOKEN or a dedicated CI decrypt key instead" >&2
exit 2
fi
if [[ ! -f "${key_path}" ]]; then
echo "error: key file not found: ${key_path}" >&2