Skip to content
Request access

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp

Previews read the deploy token from production, without making a deployment #378

Mergedsyntaqx merged 373-preview-token into main

Merged into main by syntaqx via a merge commit in b80039f

syntaqxopened this pull request

A follow-up to #373 (#377).

#377's first preview built, but its upload was skipped. CLOUDFLARE_API_TOKEN is scoped to the production environment, so a pull request job had none.

The Upload job now names environment: {name: production, deployment: false}, the same way Deploy's plan job reads production's secrets. A preview still makes no deployment record. production has no branch policy, so this is the same exposure as a repository secret: anyone who can push a branch here can already read secrets from a workflow on their pull request. Forks get no secrets and no preview.

This PR changes preview.yml, so its own Preview run is the first real upload.

Checks: preview.test.mjs (12), repository_workflows (24), prettier.

syntaqxturned on auto-merge (merge commit)·
syntaqxmerged this·
syntaqxdeleted the 373-preview-token branch·

All checks have passed

4 passed · on 910bdb8

Workflows

CI / pull_request — CI passedDetails
Dependency review — No dependency changesDetails
Preview / pull_request — Preview passedDetails
preview / web — The site as this pull request makes it

373-preview-token was deleted

It can be made again at 910bdb8, where it was.

Sign in to comment.