lux/dex
2
0
Fork 0
mirror of https://github.com/luxfi/dex.git synced 2026-09-24 00:26:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: the PAT step falls back to the one credential luxfi provisions

Browse Source 
The ghcr login here is already correct. The step after it is not: it reads
GH_TOKEN then UNIVERSE_PAT, and this forge provisions neither. Measured --
repos/luxfi/dex has no Actions secrets at all, and orgs/luxfi holds exactly
GHCR_USER + GHCR_TOKEN. Both names evaluate to "" and the step exits 1, so the
build never runs and the run reads as a build failure.

GHCR_TOKEN must be a real GitHub PAT for ghcr.io to accept it, so it can resolve
private luxfi/* and hanzos3 modules as well. Added as a third rung that reports
which secret it used, not a `||` chain that swaps credentials silently. Proven
green in luxfi/trader and luxfi/maker.

Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
zeekay
2026-08-01 17:41:14 -07:00
co-authored by Hanzo Dev
parent 20e62658cf
commit 5c8ab93cde
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.hanzo/workflows/release.yml
+8 -1
View File
@@ -74,13 +74,20 @@ jobs:
env:
GH_TOKEN: ${{ secrets.GH_TOKEN }}
UNIVERSE_PAT: ${{ secrets.UNIVERSE_PAT }}
# Measured on this forge: repos/luxfi/dex has no secrets at all and
# orgs/luxfi holds exactly GHCR_USER + GHCR_TOKEN. So GH_TOKEN and
# UNIVERSE_PAT are both "" here and the step below always exits 1.
# GHCR_TOKEN has to be a real GitHub PAT for ghcr.io to accept it, so it
# resolves private modules too.
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
run: |
set -euo pipefail
umask 077
tok="${GH_TOKEN:-}"; src=GH_TOKEN
if [ -z "$tok" ]; then tok="${UNIVERSE_PAT:-}"; src=UNIVERSE_PAT; fi
if [ -z "$tok" ]; then tok="${GHCR_TOKEN:-}"; src=GHCR_TOKEN; fi
if [ -z "$tok" ]; then
echo "::error::Neither GH_TOKEN (org) nor UNIVERSE_PAT (repo) is set — private luxfi/* and hanzos3 deps cannot be resolved."
echo "::error::None of GH_TOKEN, UNIVERSE_PAT or GHCR_TOKEN is set — private luxfi/* and hanzos3 deps cannot be resolved."
exit 1
fi
echo "::add-mask::$tok"