Lotus CIandClaude Opus 5.5
1dacf29d53
Lint / Shell (shellcheck) (push) Successful in 14s
Lint / JS (eslint) (push) Successful in 11s
Lint / No secrets in webhook configs (push) Successful in 7s
Lint / Python (ruff) (push) Successful in 13s
Lint / Python deps (pip-audit) (push) Successful in 1m46s
Lint / Secret scan (gitleaks) (push) Successful in 11s
deploy/hooks-lxc*.json in this public repo held the HMAC secrets for
every auto-deploy webhook (and 106's cinny-build token), readable
anonymously. Six values had been committed: the four matrix-deploy
secrets, 106's lotus-deploy secret (publicly reachable through
chat.lotusguild.org/hooks/lotus-deploy) and the cinny-build token.
- All six rotated on the servers and in Gitea (matrix hooks 6-9,
cinny hook 69). The old values are rejected.
- Secrets now live in /etc/webhook/secrets.env (0600) on each LXC, loaded
by a systemd drop-in that also enables webhook's -template mode; the
hooks files use {{ getenv "NAME" | js }} placeholders.
- The repo hooks files are now exact copies of the live ones, so they
also document the *-config-deploy hooks they were missing. Those
three secrets were never committed and are unchanged.
- README: where the secrets live and how to rotate one.
- CI `hooks-no-secrets` fails if a literal secret lands in a hooks
file again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
49 lines
1.2 KiB
JSON
49 lines
1.2 KiB
JSON
[
|
|
{
|
|
"id": "matrix-deploy",
|
|
"execute-command": "/usr/local/bin/matrix-deploy.sh",
|
|
"command-working-directory": "/opt/matrix-config",
|
|
"response-message": "Deploying draupnir config...",
|
|
"trigger-rule": {
|
|
"match": {
|
|
"type": "payload-hash-sha256",
|
|
"secret": "{{ getenv "MATRIX_DEPLOY_SECRET" | js }}",
|
|
"parameter": {
|
|
"source": "header",
|
|
"name": "X-Gitea-Signature"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"id": "110-config-deploy",
|
|
"execute-command": "/usr/local/bin/draupnir_deploy.sh",
|
|
"command-working-directory": "/opt/pve-infra",
|
|
"response-message": "Deploying draupnir config...",
|
|
"trigger-rule": {
|
|
"and": [
|
|
{
|
|
"match": {
|
|
"type": "payload-hash-sha256",
|
|
"secret": "{{ getenv "CONFIG_DEPLOY_SECRET" | js }}",
|
|
"parameter": {
|
|
"source": "header",
|
|
"name": "X-Gitea-Signature"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"match": {
|
|
"type": "value",
|
|
"value": "refs/heads/main",
|
|
"parameter": {
|
|
"source": "payload",
|
|
"name": "ref"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|