Docs: full Gitea URL in uses: examples; deploy key is required (was 'optional')
This commit is contained in:
@@ -39,14 +39,18 @@ jobs:
|
||||
with:
|
||||
fetch-depth: 0 # full history + the tag ref (git archive needs this)
|
||||
|
||||
- uses: wordpress/wp-release-ci@v1 # PIN to a tag or SHA — never a moving branch
|
||||
- uses: https://gitea.mulligan.casa/wordpress/wp-release-ci@v1 # full Gitea URL; PIN the ref
|
||||
with:
|
||||
channel_deploy_key: ${{ secrets.CHANNEL_DEPLOY_KEY }}
|
||||
```
|
||||
|
||||
> **Pin the ref.** Reference the action by a release tag (`@v1`) or a commit SHA, not by
|
||||
> `@main`. A composite action runs shell from its own checkout inside your repo's job; pinning
|
||||
> is what stops an upstream change from silently altering what runs against your secrets.
|
||||
> **Use the full Gitea URL.** On Gitea Actions a bare `owner/repo` in `uses:` resolves against
|
||||
> **github.com**, not this instance — it must be the full `https://gitea.mulligan.casa/…@ref` form,
|
||||
> or the runner tries to check the action out from GitHub and the job fails.
|
||||
>
|
||||
> **Pin the ref** to a release tag (`@v1`) or commit SHA, never `@main`. A composite action runs
|
||||
> shell from its own checkout inside your repo's job; pinning stops an upstream change from
|
||||
> silently altering what runs against your secrets.
|
||||
|
||||
If your project bundles a Vite app (`app_build: true`), also add a `actions/setup-node@v4` step
|
||||
before the release step.
|
||||
@@ -164,8 +168,8 @@ single `screenshot_url` built from `screenshot.png` at the repo root when presen
|
||||
|
||||
- **`CHANNEL_DEPLOY_KEY`** (secret) — an SSH private key whose **public** half is registered as a
|
||||
**deploy key with WRITE access on the channel repo** (e.g. `aa/maineaa-updates`). This is what
|
||||
lets the pipeline push the new zip + manifest. Without it, the pipeline still cuts the Gitea
|
||||
release on the source repo but **skips** the channel publish.
|
||||
lets the pipeline push the new zip + manifest. It is **required** — the publish step hard-fails
|
||||
if it's unset (`channel:` is a required target, so reaching it is required too).
|
||||
- Optionally `CHANNEL_SSH_PORT`, `CHANNEL_BRANCH`, `CHANNEL_GIT_NAME` (repo variables) if you
|
||||
need non-default values.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user