ci: the encoder submodule is private again, restore the token - #1926
Open
johan-bell wants to merge 1 commit into
Open
ci: the encoder submodule is private again, restore the token#1926johan-bell wants to merge 1 commit into
johan-bell wants to merge 1 commit into
Conversation
The repository was made public this afternoon and private again this evening, so the workflows need the credential back. `MEDIA_CONVERT_TOKEN` is a PAT or deploy key with read access to it, and does not exist yet: until it is created, App and CMS checkout fails on the submodule clone. That is a known and accepted state rather than a regression to hunt. `|| github.token` is not decoration. `actions/checkout` rejects an empty `token:` outright — "Input required and not supplied" — so pointing at a secret that does not exist would fail this repository's own checkout instead of leaving only the private submodule to fail. With the fallback an unset secret degrades to exactly the previous behaviour.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The encoder repository was made public this afternoon and private again this evening, so the workflows need the credential back — this reverses #1920.
CI will be red until
MEDIA_CONVERT_TOKENexists. A PAT or deploy key with read access tobccsa/luminary-media-convert, added to this repository as that secret. App and CMS checkout fails on the submodule clone until then; this is accepted, not a regression to investigate.|| github.tokenis load-bearing rather than defensive:actions/checkoutrejects an emptytoken:outright ("Input required and not supplied"), so pointing at a secret that does not exist would break this repository's own checkout rather than leaving only the private submodule to fail. That was #1919's lesson, learned the hard way.A fine-grained PAT scoped to that one repository with
Contents: Read-onlyis the narrowest option; a read-only deploy key avoids account-wide reach but needs an SSH setup step instead oftoken:— say which and I will adjust.