recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

config: load public cc-ci runtime environment #14

Merged
autonomic-bot merged 1 commits from chore/public-runtime-config into main 2026-08-31 16:50:26 +00:00
Conversation 0 Commits 1 Files Changed 15
+60 -28
autonomic-bot commented 2026-08-31 16:50:07 +00:00
Owner
Copy Link
Copy Source

What changed

Adds a single load-env.sh helper that loads the CI product's tracked .env.public before the local secret .testenv, and switches every OpenCode launcher plus the Gitea API helpers to use it. The OpenCode systemd service now reads both files in that order.

Why

GITEA_USERNAME, TINFOIL_MODEL, and TINFOIL_BASE_URL are public configuration, not credentials. Moving them out of /secrets removes 49 misleading secret-scan findings while preserving the secret boundary for passwords, API keys, and tokens. The tracked public file landed in cc-ci PR #22.

Evidence

  • Combined shell loader: PASS.
  • Python callers (pr-survey, recipe-report, advisory-scan): PASS.
  • Python compilation, Bash syntax, TOML parse, and Nix syntax: PASS.
  • Full secret audit: 58 secret values scanned; 0 findings.
## What changed Adds a single `load-env.sh` helper that loads the CI product's tracked `.env.public` before the local secret `.testenv`, and switches every OpenCode launcher plus the Gitea API helpers to use it. The OpenCode systemd service now reads both files in that order. ## Why `GITEA_USERNAME`, `TINFOIL_MODEL`, and `TINFOIL_BASE_URL` are public configuration, not credentials. Moving them out of `/secrets` removes 49 misleading secret-scan findings while preserving the secret boundary for passwords, API keys, and tokens. The tracked public file landed in cc-ci PR #22. ## Evidence - Combined shell loader: PASS. - Python callers (`pr-survey`, `recipe-report`, `advisory-scan`): PASS. - Python compilation, Bash syntax, TOML parse, and Nix syntax: PASS. - Full secret audit: 58 secret values scanned; 0 findings.
autonomic-bot added 1 commit 2026-08-31 16:50:08 +00:00
config: load public cc-ci runtime environment 00a4ee6752
autonomic-bot merged commit 07bc0a15d5 into main 2026-08-31 16:50:26 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci-orchestrator#14