Docs: full Gitea URL in uses: examples; deploy key is required (was 'optional')

This commit is contained in:
Mike Mulligan
2026-07-15 17:38:06 -04:00
parent ff637932ae
commit 3a45b3d8b4
2 changed files with 12 additions and 8 deletions
+10 -6
View File
@@ -39,14 +39,18 @@ jobs:
with:
fetch-depth: 0 # full history + the tag ref (git archive needs this)
- uses: wordpress/wp-release-ci@v1 # PIN to a tag or SHA — never a moving branch
- uses: https://gitea.mulligan.casa/wordpress/wp-release-ci@v1 # full Gitea URL; PIN the ref
with:
channel_deploy_key: ${{ secrets.CHANNEL_DEPLOY_KEY }}
```
> **Pin the ref.** Reference the action by a release tag (`@v1`) or a commit SHA, not by
> `@main`. A composite action runs shell from its own checkout inside your repo's job; pinning
> is what stops an upstream change from silently altering what runs against your secrets.
> **Use the full Gitea URL.** On Gitea Actions a bare `owner/repo` in `uses:` resolves against
> **github.com**, not this instance — it must be the full `https://gitea.mulligan.casa/…@ref` form,
> or the runner tries to check the action out from GitHub and the job fails.
>
> **Pin the ref** to a release tag (`@v1`) or commit SHA, never `@main`. A composite action runs
> shell from its own checkout inside your repo's job; pinning stops an upstream change from
> silently altering what runs against your secrets.
If your project bundles a Vite app (`app_build: true`), also add a `actions/setup-node@v4` step
before the release step.
@@ -164,8 +168,8 @@ single `screenshot_url` built from `screenshot.png` at the repo root when presen
- **`CHANNEL_DEPLOY_KEY`** (secret) — an SSH private key whose **public** half is registered as a
**deploy key with WRITE access on the channel repo** (e.g. `aa/maineaa-updates`). This is what
lets the pipeline push the new zip + manifest. Without it, the pipeline still cuts the Gitea
release on the source repo but **skips** the channel publish.
lets the pipeline push the new zip + manifest. It is **required** — the publish step hard-fails
if it's unset (`channel:` is a required target, so reaching it is required too).
- Optionally `CHANNEL_SSH_PORT`, `CHANNEL_BRANCH`, `CHANNEL_GIT_NAME` (repo variables) if you
need non-default values.