actions/static-site-deploy
Watch
1
0
Fork
You've already forked static-site-deploy
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(static-site-deploy): deploy with the workflow's OIDC identity
All checks were successful
Test / test (push) Successful in 9s
Details

Browse source 
Without BUNNY_STORAGE_PASSWORD, the action now requests the running
workflow's OIDC identity token (Forgejo with enable-openid-connect,
GitHub with id-token: write) for the gateway's audience and starts the
deployment with it. It takes the Storage Zone password from the
gateway's answer, masks it in the log, plans and uploads with it, and
finalizes or aborts with a fresh token. A dry run in this mode stays
local. Password deployments work as before.

action.yml finds its script under FORGEJO_ACTION_PATH or
GITHUB_ACTION_PATH, so the action also runs on GitHub Actions.
This commit is contained in:
Eric Wendland 2026-10-02 23:29:58 +02:00
commit c242db40a1
4 changed files with 247 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

3
action.yml
View file

@ -56,4 +56,5 @@ runs:
echo "dry-run must be true or false" >&2
exit 2
fi
python3 "$FORGEJO_ACTION_PATH/static_site.py" "${args[@]}"
# Forgejo and GitHub name the action's checkout differently.
python3 "${FORGEJO_ACTION_PATH:-$GITHUB_ACTION_PATH}/static_site.py" "${args[@]}"