fix(docs): pass secrets to the reusable documentation workflow #23
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Documentation | ||
| on: | ||
| push: | ||
| branches: [development] | ||
| pull_request: | ||
| branches: [development] | ||
| jobs: | ||
| deploy: | ||
| uses: ConductionNL/.github/.github/workflows/documentation.yml@main | ||
| # A reusable workflow receives NO secrets by default. Without this block | ||
| # `secrets.CF_API_TOKEN` is empty inside the callee, its "Publish to the | ||
| # Cloudflare Worker" step skips itself on its own guard, and the run | ||
| # finishes GREEN having written only gh-pages — which nothing serves. The | ||
| # live site never changes and no check goes red to say so. | ||
| # | ||
| # Mapped explicitly rather than `secrets: inherit`, because `inherit` | ||
| # hands the callee EVERY secret this repo holds — signing cert and key, | ||
| # appstore token, deploy keys — for the sake of two Cloudflare values. | ||
| # This way only those two cross the boundary. | ||
| # | ||
| # The names also differ on each side (org `CLOUDFLARE_*`, callee `CF_*`), | ||
| # and `inherit` passes secrets under their ORIGINAL names — so it would | ||
| # have left `CF_API_TOKEN` empty even setting the exposure aside. Needs | ||
| # ConductionNL/.github#568: a mapping only compiles for secrets the callee | ||
| # declares. | ||
| secrets: | ||
| CF_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
|
Check failure on line 29 in .github/workflows/documentation.yml
|
||
| CF_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
| with: | ||
| # `keepiq.conduction.nl` resolves as of 2026-08-23 — attached as a second | ||
| # custom domain on the SAME `doriath-docs` worker that serves | ||
| # `doriath.conduction.nl`. Both hosts answer, so nothing goes dark either | ||
| # way. docs-hosts must list BOTH: wrangler reconciles the worker's | ||
| # triggers against it, so a host omitted there is removed. Keep this in | ||
| # step with docs/static/CNAME. | ||
| cname: keepiq.conduction.nl | ||
| docs-hosts: doriath.conduction.nl,keepiq.conduction.nl | ||
| # Named explicitly, because the comment above already knows the answer | ||
| # and the workflow did not. The callee derives the worker from `cname` | ||
| # when not told — `keepiq-docs`, which does not exist. Deploying that | ||
| # creates a SECOND worker while both custom domains keep routing to | ||
| # `doriath-docs`: every deploy green, reaching nobody. Renaming the | ||
| # worker is a Cloudflare-side move, not something this file can perform. | ||
| worker-name: doriath-docs | ||
