From 3047ee7724831b1f7d517e3d9afac964bf07c135 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Wed, 26 Aug 2026 17:46:58 +0000 Subject: [PATCH] config: GITEA_URL is public config, not a credential The Gitea host was stored in the credentials env file, so a literal secret scanner treated it as a secret and refused two READMEs in another repo that link to git.autonomic.zone. It was never secret: advisory-scan.py, pr-survey.py and recipe-report.py already default it to git.autonomic.zone, and it is this repo's own remote host. It is a bare hostname with no scheme, userinfo or path. Removed from the env file and defaulted here the same way the Python already does. GITEA_USERNAME and GITEA_PASSWORD keep their :? guard -- those are real credentials and must still fail loudly if unset. --- cc-ci-plan/reconcile-upstream.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cc-ci-plan/reconcile-upstream.sh b/cc-ci-plan/reconcile-upstream.sh index 0ac88cb..5ecf8f0 100755 --- a/cc-ci-plan/reconcile-upstream.sh +++ b/cc-ci-plan/reconcile-upstream.sh @@ -36,7 +36,7 @@ USED_RECIPES="${USED_RECIPES:-$HERE/used-recipes.md}" [ -f "$RECONCILE" ] || { echo "ERROR: reconcile helper not found: $RECONCILE" >&2; exit 1; } set -a; . "$TESTENV"; set +a -: "${GITEA_USERNAME:?}"; : "${GITEA_PASSWORD:?}"; : "${GITEA_URL:?}" +: "${GITEA_USERNAME:?}"; : "${GITEA_PASSWORD:?}"; : "${GITEA_URL:=git.autonomic.zone}" if [ "${1:-}" = "--all" ]; then mapfile -t RECIPES < <(awk '!/^[[:space:]]*#/ && ($2=="weekly" || $2=="external") {print $1}' "$USED_RECIPES")