From f0f82d904b2b67a1418863af5bd699f094560436 Mon Sep 17 00:00:00 2001 From: Mumuni Date: Fri, 25 Sep 2026 15:28:58 +0000 Subject: [PATCH] security: remove hardcoded abiba-bot credentials from deploy workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Completes aeb79c6 (main): four more clone steps in deploy.yml still embedded abiba-bot HTTP Basic credentials in plaintext. Runner already auto-checkouts the repo, so the manual clone was redundant — replaced with actions/checkout@v4, same pattern as ci.yml. No secrets remain in tracked workflow files after this change. --- .gitea/workflows/deploy.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 9014fe0..8f6a425 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - run: git clone --depth 1 http://abiba-bot:***REMOVED***@192.168.68.17:3000/SyslogSolution/zulip-platform-plugins.git . + uses: actions/checkout@v4 - name: Python syntax run: | python3 -m py_compile plugins/platforms/zulip/adapter.py 2>/dev/null @@ -37,7 +37,7 @@ jobs: environment: canary steps: - name: Checkout - run: git clone --depth 1 http://abiba-bot:***REMOVED***@192.168.68.17:3000/SyslogSolution/zulip-platform-plugins.git . + uses: actions/checkout@v4 - name: Deploy to Tanko env: TAG: ${{ github.ref_name }} @@ -66,7 +66,7 @@ jobs: environment: production steps: - name: Checkout - run: git clone --depth 1 http://abiba-bot:***REMOVED***@192.168.68.17:3000/SyslogSolution/zulip-platform-plugins.git . + uses: actions/checkout@v4 - name: Deploy to all Hermes agents env: TAG: ${{ github.ref_name }} @@ -97,7 +97,7 @@ jobs: environment: agent-zero steps: - name: Checkout - run: git clone --depth 1 http://abiba-bot:***REMOVED***@192.168.68.17:3000/SyslogSolution/zulip-platform-plugins.git . + uses: actions/checkout@v4 - name: Deploy to kagentz env: TAG: ${{ github.ref_name }}