Repository navigation
Drop the deploy keys now that pdl and cdl are public; keep fork PRs working - #27
Merged
Merged
Conversation
The repository is public now, so pull requests can come from forks, and those (like Dependabot's) get none of its secrets. CI's analysis, tests and builds load deploy keys for the private pdl and cdl packages, and the release trial also needs the signing keys; both would fail on the missing secrets rather than say why. analyze-and-test and the release workflow's version job now run only for pushes and same-repository pull requests; the jobs that need them skip with them. A fork-note job tells a fork's author why, and that the checks run once a maintainer takes the change in. workflow-lint and detect-native-changes, which need no secrets, still run for everyone. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Every job loaded read-only deploy keys for the two format repositories, private until now. They are public, and the app fetches them over https (the submodule URLs and the pub git URLs), so the keys are not needed: CI says to drop them once the repositories are public. Without them, a fork's or Dependabot's pull request can run the whole of CI, so analyze-and-test no longer skips those and fork-note goes. The release trial still runs only for same-repository pull requests: it needs the signing keys, and a macOS build is the dearest minute there is. The PDL_DEPLOY_KEY and CDL_DEPLOY_KEY secrets, and the deploy keys on the two repositories, can be deleted. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
burhankhanzada
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pdlandcdlare public now, and the app fetches them over https (submodule URLs and pub git URLs), so the read-only deploy keys every job loaded aren't needed; CI's own comment said to drop them once the repos went public.webfactory/ssh-agentdeploy-key steps (three inci.yml, two inrelease.yml).cla.yml'spull_request_targetis the standard CLA-assistant setup (no PR code checked out, action pinned by SHA), so it's safe in a public repo.After merging, you can delete the
PDL_DEPLOY_KEY/CDL_DEPLOY_KEYsecrets here and the deploy keys onpdl/cdl. Passes actionlint.🤖 Generated with Claude Code