ci: staging-check echoes INFRA_DISPATCH_TOKEN into the job log (main) #12

New issue

Open

opened 2026-10-19 17:56:56 -04:00 by jfraeys · 0 comments

jfraeys commented

2026-10-19 17:56:56 -04:00

Owner

On main, .forgejo/workflows/ci.yml has a debug step ("Test INFRA_DISPATCH_TOKEN availability", around line 287) that runs echo "INFRA_DISPATCH_TOKEN: ${{ secrets.INFRA_DISPATCH_TOKEN }}". Forgejo masks secrets in logs, but this still writes the value into the job's command line and log, and the step does nothing the dispatch step doesn't.

Remove the step. The branch version of the workflow (PR #9/#10) doesn't have it.
Rotate INFRA_DISPATCH_TOKEN if any run on main printed it unmasked.
main also still has jfraeysd/infra (comment at line 271 and INFRA_REPO at line 306). PR #9 fixes it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B1FuEx3w8ax6P8QvdxxADM

On `main`, `.forgejo/workflows/ci.yml` has a debug step ("Test INFRA_DISPATCH_TOKEN availability", around line 287) that runs `echo "INFRA_DISPATCH_TOKEN: ${{ secrets.INFRA_DISPATCH_TOKEN }}"`. Forgejo masks secrets in logs, but this still writes the value into the job's command line and log, and the step does nothing the dispatch step doesn't. - [ ] Remove the step. The branch version of the workflow (PR #9/#10) doesn't have it. - [ ] Rotate `INFRA_DISPATCH_TOKEN` if any run on `main` printed it unmasked. - [ ] `main` also still has `jfraeysd/infra` (comment at line 271 and `INFRA_REPO` at line 306). PR #9 fixes it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01B1FuEx3w8ax6P8QvdxxADM

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/coaching-site#12

No description provided.

Rows
Columns