From b8005ac53f67b2bed22fd006fbb781c03687a9b7 Mon Sep 17 00:00:00 2001 From: Johan Bell Date: Wed, 19 Aug 2026 17:36:16 +0200 Subject: [PATCH] ci: the encoder submodule is private again, restore the token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The repository was made public this afternoon and private again this evening, so the workflows need the credential back. `MEDIA_CONVERT_TOKEN` is a PAT or deploy key with read access to it, and does not exist yet: until it is created, App and CMS checkout fails on the submodule clone. That is a known and accepted state rather than a regression to hunt. `|| github.token` is not decoration. `actions/checkout` rejects an empty `token:` outright — "Input required and not supplied" — so pointing at a secret that does not exist would fail this repository's own checkout instead of leaving only the private submodule to fail. With the fallback an unset secret degrades to exactly the previous behaviour. --- .github/workflows/app-deploy-staging.yml | 16 +++++++++++++--- .github/workflows/app-unit-tests.yml | 16 +++++++++++++--- .github/workflows/cms-deploy-staging.yml | 16 +++++++++++++--- .github/workflows/cms-unit-tests.yml | 16 +++++++++++++--- 4 files changed, 52 insertions(+), 12 deletions(-) diff --git a/.github/workflows/app-deploy-staging.yml b/.github/workflows/app-deploy-staging.yml index f364b9560c..5bc7e1abb4 100644 --- a/.github/workflows/app-deploy-staging.yml +++ b/.github/workflows/app-deploy-staging.yml @@ -34,10 +34,20 @@ jobs: - name: Checkout repository uses: actions/checkout@v5 with: - # The encoder's player packages are consumed from luminary-media-convert/, which is - # a submodule rather than a published package. The submodule repository is - # public, so the built-in token suffices; no extra credential is needed. + # The encoder's player packages are consumed from luminary-media-convert/, + # which is a submodule rather than a published package. + # + # That repository is private, and a workflow's GITHUB_TOKEN reaches only the + # repository it runs in — a private sibling answers "Repository not found" + # and checkout aborts before any step runs. MEDIA_CONVERT_TOKEN is a + # credential with read access to it. + # + # The fallback matters: `actions/checkout` rejects an empty `token:` + # outright ("Input required and not supplied"), which would break this + # repository's own checkout while the secret is unset, rather than leaving + # only the submodule to fail. submodules: true + token: ${{ secrets.MEDIA_CONVERT_TOKEN || github.token }} - name: Create .env file run: | diff --git a/.github/workflows/app-unit-tests.yml b/.github/workflows/app-unit-tests.yml index 9eb385510c..67ebbe810e 100644 --- a/.github/workflows/app-unit-tests.yml +++ b/.github/workflows/app-unit-tests.yml @@ -23,10 +23,20 @@ jobs: - name: Checkout repository uses: actions/checkout@v5 with: - # The encoder's player packages are consumed from luminary-media-convert/, which is - # a submodule rather than a published package. The submodule repository is - # public, so the built-in token suffices; no extra credential is needed. + # The encoder's player packages are consumed from luminary-media-convert/, + # which is a submodule rather than a published package. + # + # That repository is private, and a workflow's GITHUB_TOKEN reaches only the + # repository it runs in — a private sibling answers "Repository not found" + # and checkout aborts before any step runs. MEDIA_CONVERT_TOKEN is a + # credential with read access to it. + # + # The fallback matters: `actions/checkout` rejects an empty `token:` + # outright ("Input required and not supplied"), which would break this + # repository's own checkout while the secret is unset, rather than leaving + # only the submodule to fail. submodules: true + token: ${{ secrets.MEDIA_CONVERT_TOKEN || github.token }} - name: Setup Node.js uses: actions/setup-node@v6 diff --git a/.github/workflows/cms-deploy-staging.yml b/.github/workflows/cms-deploy-staging.yml index 51ff4bc67d..9580e5fca6 100644 --- a/.github/workflows/cms-deploy-staging.yml +++ b/.github/workflows/cms-deploy-staging.yml @@ -34,10 +34,20 @@ jobs: - name: Checkout repository uses: actions/checkout@v5 with: - # The encoder's player packages are consumed from luminary-media-convert/, which is - # a submodule rather than a published package. The submodule repository is - # public, so the built-in token suffices; no extra credential is needed. + # The encoder's player packages are consumed from luminary-media-convert/, + # which is a submodule rather than a published package. + # + # That repository is private, and a workflow's GITHUB_TOKEN reaches only the + # repository it runs in — a private sibling answers "Repository not found" + # and checkout aborts before any step runs. MEDIA_CONVERT_TOKEN is a + # credential with read access to it. + # + # The fallback matters: `actions/checkout` rejects an empty `token:` + # outright ("Input required and not supplied"), which would break this + # repository's own checkout while the secret is unset, rather than leaving + # only the submodule to fail. submodules: true + token: ${{ secrets.MEDIA_CONVERT_TOKEN || github.token }} - name: Create .env file run: | diff --git a/.github/workflows/cms-unit-tests.yml b/.github/workflows/cms-unit-tests.yml index 6fdc0dffa3..9245851823 100644 --- a/.github/workflows/cms-unit-tests.yml +++ b/.github/workflows/cms-unit-tests.yml @@ -23,10 +23,20 @@ jobs: - name: Checkout repository uses: actions/checkout@v5 with: - # The encoder's player packages are consumed from luminary-media-convert/, which is - # a submodule rather than a published package. The submodule repository is - # public, so the built-in token suffices; no extra credential is needed. + # The encoder's player packages are consumed from luminary-media-convert/, + # which is a submodule rather than a published package. + # + # That repository is private, and a workflow's GITHUB_TOKEN reaches only the + # repository it runs in — a private sibling answers "Repository not found" + # and checkout aborts before any step runs. MEDIA_CONVERT_TOKEN is a + # credential with read access to it. + # + # The fallback matters: `actions/checkout` rejects an empty `token:` + # outright ("Input required and not supplied"), which would break this + # repository's own checkout while the secret is unset, rather than leaving + # only the submodule to fail. submodules: true + token: ${{ secrets.MEDIA_CONVERT_TOKEN || github.token }} - name: Setup Node.js uses: actions/setup-node@v6