From f2e6eaa6386248d165126619f294234171768c87 Mon Sep 17 00:00:00 2001 From: David Date: Sun, 13 Sep 2026 10:38:31 +0200 Subject: [PATCH 1/2] chore(screenshots): enable permanent PR image publishing --- .sops.yaml | 3 +++ config/screenshots.yaml | 6 ++++++ secrets/assets.example.yaml | 8 ++++++++ secrets/assets.yaml | 28 ++++++++++++++++++++++++++++ 4 files changed, 45 insertions(+) create mode 100644 config/screenshots.yaml create mode 100644 secrets/assets.example.yaml create mode 100644 secrets/assets.yaml diff --git a/.sops.yaml b/.sops.yaml index d04b13f..970f189 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -12,3 +12,6 @@ creation_rules: - path_regex: secrets/ci\.yaml$ key_groups: - age: [*david-z890-nixos, *david-x1-nixos, *papersync-ci] + - path_regex: secrets/assets\.yaml$ + key_groups: + - age: [*david-z890-nixos, *david-x1-nixos] diff --git a/config/screenshots.yaml b/config/screenshots.yaml new file mode 100644 index 0000000..aa44225 --- /dev/null +++ b/config/screenshots.yaml @@ -0,0 +1,6 @@ +# Public, permanent PR evidence in the shared bucket owned by personal-infra. +# The pair names PaperSync's own bucket-scoped credential; no other project's credential is reused. +pair: assets:assets.screenshots_rw +bucket: personal-pr-screenshots +endpoint: https://831f91724ea62b0cb0215829eb001f66.eu.r2.cloudflarestorage.com +publicBaseUrl: https://screenshots.vornholt.online diff --git a/secrets/assets.example.yaml b/secrets/assets.example.yaml new file mode 100644 index 0000000..eb97f29 --- /dev/null +++ b/secrets/assets.example.yaml @@ -0,0 +1,8 @@ +assets: + # Required by `bun standards screenshots publish`; no default. + # Mint PaperSync's own 90-day, EU-bucket-scoped pair with: + # bun standards creds add cloudflare --account 831f91724ea62b0cb0215829eb001f66 --dest assets:assets.screenshots_rw --bucket personal-pr-screenshots --jurisdiction eu --s3 --permissions "Workers R2 Storage Bucket Item Write" + # Reconcile/renew with `bun standards creds plan` and `bun standards creds apply`. + screenshots_rw: + access_key_id: replace-with-r2-access-key-id + secret_access_key: replace-with-r2-secret-access-key diff --git a/secrets/assets.yaml b/secrets/assets.yaml new file mode 100644 index 0000000..66d2fb3 --- /dev/null +++ b/secrets/assets.yaml @@ -0,0 +1,28 @@ +assets: + screenshots_rw: + access_key_id: ENC[AES256_GCM,data:blDHuIpr1RAUTcbXk43hmGqZkfaUYNHeoulPNNkCdG8=,iv:F+XkQnp4On6C89sWgw6Yz7v1p9Rl6DFCR1XFOlfBEYY=,tag:k8FTlgx5bWaOV1BDse4qYg==,type:str] + secret_access_key: ENC[AES256_GCM,data:/ANk3mO9MEvioAJK8mrjpNxvWP2SjtLLEKdWd3gb4iIZ9bigQ0dSjKGH/d83CKtfIREDVQ2C3+l2q+3iY8PvTg==,iv:JuMTIkW7OuTwcq2ksmDLREvlyT83vnhiq7BS6lCB49E=,tag:gRS+i/amlWjzlsVvhmVJzw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNQ1I3T3hpQkQvTWtMMVBZ + STdHZkF5YnZWTUcvQUlBRTA1bjhENTQ4V3hjCmZoajRmSFRrTWZMSXVrYU8rN2Iz + N2VBRUxuQmVwV0xLL2J3d1lvNDNLN1kKLS0tIDN6MHhOeTlCYUJtYWFvK1VRM25W + dUp1WHFJQzFodVRvZ0NLK3JLY3VOVTQKw298aDTakLdc5BQ/1RMOqNbQAVtVr+3z + qGivQd7QCEqfEuWeGQgSzSbt4EV8c6I5N8a2UAA/N5HynqFWFIz48w== + -----END AGE ENCRYPTED FILE----- + recipient: age1gxzu2f027zu227f4wyf4jh5sw0w495482qfzv5flmfyjvgzxm3ys8p9muz + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvaEo2SmY2MDVtNVNSUmRI + cHVQME5UZ0RsQlc1aS9ORmgxaXg2RnhwTVVJCjh5a0xtZjlhcis5MVdjd29Vd0lK + c2plbWVMVm9ZM0c5bVI2dHhQd094SjAKLS0tIDZNY0VXaFVUN2RrYnNpY0R2cytK + T1JQdFJXWkFRNkdBRDIyUkNYOXp4OGsKRqpGLvtKDqj0UC8Kn0kJf76DAzOLogdj + BjwifaWJ28l3LK91zQbf0SwQrzsx/J+/n2xZoVn4rq11fRKh3teNBA== + -----END AGE ENCRYPTED FILE----- + recipient: age1cgudsv52h62snquglvayft2n4ck522x4at5aja57un06w9w0gszqzfqtce + lastmodified: "2026-09-13T08:32:45Z" + mac: ENC[AES256_GCM,data:G+jd2hr9a/pOrJA9XPXOJxi4wmd/IbDbLH4IJazAQJ8zVtH7Wb605i+yk/m6DWb9sMc+j+fK8NzlwRFBejHYknuGpjyMrl5aUbsTSToJ9kMH5QFjsEgZU3Fxjheg2LLFcyVWvP3lyf40s6b5T/zGfAG3B/OOx7BgpKO4aoqjbnY=,iv:U4dKbbZuWQZKJTwVhAhSBPYMmeMnhO1XvRVY5uBvsmY=,tag:618Vrn/pYhE4aml7GoAW3w==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3 From d7538991e3fbed3f2d09966978c07234adef1efb Mon Sep 17 00:00:00 2001 From: David Date: Sun, 13 Sep 2026 10:49:36 +0200 Subject: [PATCH 2/2] docs(screenshots): explain the publishing workflow --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 485db35..3c34da8 100644 --- a/README.md +++ b/README.md @@ -19,6 +19,10 @@ bun run dev:web Run `bun run check:fix` for formatting, lint, type checks, tests, production builds, and browser accessibility checks. The database must be running for integration tests. +## PR screenshots + +Capture matched before/after images with demo data, then run `bun standards screenshots publish ` from the repository root. Publishing uses the [configured shared screenshot bucket](config/screenshots.yaml) and PaperSync's encrypted credential. The returned Markdown links are public and permanent; follow the [screenshot skill](.agents/skills/screenshots-in-prs/SKILL.md) when adding them to a PR. + ## Workspace layout - `apps/web`: Next.js application, scan review, authentication, and import queue API