From 9eef653a6091d12c37181567b3a8f57a685cd4f8 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Sun, 30 Aug 2026 20:12:31 +0800 Subject: [PATCH] fix: prefer control-plane runtime target variable Co-Authored-By: Codex --- .github/workflows/ci.yml | 4 ++-- .github/workflows/execution-report-heartbeat.yml | 2 +- .github/workflows/runtime-target-lifecycle.yml | 2 +- .github/workflows/sync-cloud-run-env.yml | 4 +++- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dcfd92e..0958778 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,8 +19,8 @@ jobs: - name: Reject public runtime configuration bindings run: | set -euo pipefail - if rg -n '\$\{\{[[:space:]]*vars\.(CLOUD_RUN_SERVICE_TARGETS_JSON|RUNTIME_TARGET_JSON|GLOBAL_TELEGRAM_CHAT_ID|CLOUD_RUN_SERVICES|CLOUD_RUN_SERVICE|RUNTIME_HEARTBEAT_REQUIRED_SERVICES|RUNTIME_GUARD_SCHEDULER_JOB_PATTERN)' .github/workflows; then - echo "Operational runtime configuration must use GitHub Secrets, not GitHub Variables." >&2 + if rg -n '\$\{\{[[:space:]]*vars\.(CLOUD_RUN_SERVICE_TARGETS_JSON|GLOBAL_TELEGRAM_CHAT_ID|CLOUD_RUN_SERVICES|CLOUD_RUN_SERVICE|RUNTIME_HEARTBEAT_REQUIRED_SERVICES|RUNTIME_GUARD_SCHEDULER_JOB_PATTERN)' .github/workflows; then + echo "Sensitive operational runtime configuration must use GitHub Secrets, not GitHub Variables." >&2 exit 1 fi diff --git a/.github/workflows/execution-report-heartbeat.yml b/.github/workflows/execution-report-heartbeat.yml index 4303249..6ac776c 100644 --- a/.github/workflows/execution-report-heartbeat.yml +++ b/.github/workflows/execution-report-heartbeat.yml @@ -50,7 +50,7 @@ jobs: RUNTIME_HEARTBEAT_SCHEDULER_AWARE: ${{ vars.RUNTIME_HEARTBEAT_SCHEDULER_AWARE || 'true' }} RUNTIME_HEARTBEAT_SCHEDULER_LOCATION: ${{ vars.RUNTIME_HEARTBEAT_SCHEDULER_LOCATION || vars.CLOUD_RUN_REGION || 'us-central1' }} RUNTIME_TARGET_ENABLED: ${{ vars.RUNTIME_TARGET_ENABLED }} - RUNTIME_TARGET_JSON: ${{ secrets.RUNTIME_TARGET_JSON }} + RUNTIME_TARGET_JSON: ${{ vars.RUNTIME_TARGET_JSON || secrets.RUNTIME_TARGET_JSON }} CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }} CLOUD_RUN_SERVICE: ${{ secrets.CLOUD_RUN_SERVICE }} CLOUD_RUN_SERVICES: ${{ secrets.CLOUD_RUN_SERVICES }} diff --git a/.github/workflows/runtime-target-lifecycle.yml b/.github/workflows/runtime-target-lifecycle.yml index 0845a1e..16229e2 100644 --- a/.github/workflows/runtime-target-lifecycle.yml +++ b/.github/workflows/runtime-target-lifecycle.yml @@ -24,7 +24,7 @@ jobs: id-token: write env: RUNTIME_TARGET_ENABLED: ${{ vars.RUNTIME_TARGET_ENABLED }} - RUNTIME_TARGET_JSON: ${{ secrets.RUNTIME_TARGET_JSON }} + RUNTIME_TARGET_JSON: ${{ vars.RUNTIME_TARGET_JSON || secrets.RUNTIME_TARGET_JSON }} FIRSTRADE_DRY_RUN_ONLY: ${{ vars.FIRSTRADE_DRY_RUN_ONLY }} CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }} CLOUD_RUN_SERVICE: ${{ secrets.CLOUD_RUN_SERVICE }} diff --git a/.github/workflows/sync-cloud-run-env.yml b/.github/workflows/sync-cloud-run-env.yml index 27867ab..cee809d 100644 --- a/.github/workflows/sync-cloud-run-env.yml +++ b/.github/workflows/sync-cloud-run-env.yml @@ -52,7 +52,9 @@ jobs: FIRSTRADE_MFA_EMAIL_SECRET_NAME: ${{ vars.FIRSTRADE_MFA_EMAIL_SECRET_NAME }} FIRSTRADE_MFA_PHONE_SECRET_NAME: ${{ vars.FIRSTRADE_MFA_PHONE_SECRET_NAME }} FIRSTRADE_MFA_CODE_SECRET_NAME: ${{ vars.FIRSTRADE_MFA_CODE_SECRET_NAME }} - RUNTIME_TARGET_JSON: ${{ secrets.RUNTIME_TARGET_JSON }} + # This is validated deployment intent, not credential material. Prefer the + # control-plane variable while retaining a legacy-secret fallback during migration. + RUNTIME_TARGET_JSON: ${{ vars.RUNTIME_TARGET_JSON || secrets.RUNTIME_TARGET_JSON }} ACCOUNT_PREFIX: ${{ vars.ACCOUNT_PREFIX }} ACCOUNT_REGION: ${{ vars.ACCOUNT_REGION }} FIRSTRADE_ACCOUNT: ${{ vars.FIRSTRADE_ACCOUNT }}