From f1e50eac446550b872d3996cd74b98b647087fd5 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Mon, 24 Aug 2026 18:09:30 +0200 Subject: [PATCH 1/2] fix(docs): pass secrets to the reusable documentation workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A called workflow receives no secrets from its caller unless they are passed explicitly or inherited. Without `secrets: inherit` the callee sees an empty `secrets.CF_API_TOKEN`, its "Publish to the Cloudflare Worker" step skips itself on its own guard, and the run finishes green having written only gh-pages — which nothing serves. The live docs site never changes and no check goes red to say so. Measured on planninq run 32715324775: all three jobs green, GitHub Pages deploy success, Worker publish skipped, warn step reporting the Worker was not updated. --- .github/workflows/documentation.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 096f0878..42034343 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -9,6 +9,15 @@ on: jobs: deploy: uses: ConductionNL/.github/.github/workflows/documentation.yml@main + # A called workflow receives NO secrets from its caller unless they are + # passed explicitly or inherited — `with:` carries inputs, never secrets. + # Without this line `secrets.CF_API_TOKEN` is EMPTY inside the callee, so + # its "Publish to the Cloudflare Worker" step skips itself on its own + # guard and the run finishes GREEN having written only gh-pages, which + # nothing serves. The live site never changes and no check goes red to + # say so — the exact failure mode the pinned inputs below guard against, + # arriving one layer earlier. + secrets: inherit with: # `keepiq.conduction.nl` resolves as of 2026-08-23 — attached as a second # custom domain on the SAME `doriath-docs` worker that serves From 562aa301aebcc3d44dfd44f1c702e0deb8ef446c Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Mon, 24 Aug 2026 18:24:20 +0200 Subject: [PATCH 2/2] fix(docs): map the Cloudflare secrets explicitly instead of inheriting all MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `secrets: inherit` handed the reusable documentation workflow every secret this repo holds — the Nextcloud signing cert and key, the appstore token, the deploy keys — for the sake of two Cloudflare values. It also would not have worked. The org secrets are CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID and `inherit` passes secrets under their original names, while the callee reads CF_API_TOKEN / CF_ACCOUNT_ID — so the publish step would still have skipped itself and the run would still have gone green over an unchanged live site. Maps the two names explicitly instead, so nothing else crosses the boundary. Depends on ConductionNL/.github#568, which declares both as optional secrets on the callee: an explicit mapping only compiles for names the callee declares. --- .github/workflows/documentation.yml | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 42034343..9c751d6b 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -9,15 +9,25 @@ on: jobs: deploy: uses: ConductionNL/.github/.github/workflows/documentation.yml@main - # A called workflow receives NO secrets from its caller unless they are - # passed explicitly or inherited — `with:` carries inputs, never secrets. - # Without this line `secrets.CF_API_TOKEN` is EMPTY inside the callee, so - # its "Publish to the Cloudflare Worker" step skips itself on its own - # guard and the run finishes GREEN having written only gh-pages, which - # nothing serves. The live site never changes and no check goes red to - # say so — the exact failure mode the pinned inputs below guard against, - # arriving one layer earlier. - secrets: inherit + # A reusable workflow receives NO secrets by default. Without this block + # `secrets.CF_API_TOKEN` is empty inside the callee, its "Publish to the + # Cloudflare Worker" step skips itself on its own guard, and the run + # finishes GREEN having written only gh-pages — which nothing serves. The + # live site never changes and no check goes red to say so. + # + # Mapped explicitly rather than `secrets: inherit`, because `inherit` + # hands the callee EVERY secret this repo holds — signing cert and key, + # appstore token, deploy keys — for the sake of two Cloudflare values. + # This way only those two cross the boundary. + # + # The names also differ on each side (org `CLOUDFLARE_*`, callee `CF_*`), + # and `inherit` passes secrets under their ORIGINAL names — so it would + # have left `CF_API_TOKEN` empty even setting the exposure aside. Needs + # ConductionNL/.github#568: a mapping only compiles for secrets the callee + # declares. + secrets: + CF_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} + CF_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} with: # `keepiq.conduction.nl` resolves as of 2026-08-23 — attached as a second # custom domain on the SAME `doriath-docs` worker that serves