Skip to content

ci(flatpak): push the Flatpak index with the docs deploy key - #257

Merged
hanthor merged 1 commit into
mainfrom
ci/flatpak-index-deploy-key
Nov 10, 2026
Merged

hanthor merged 1 commit into
mainfrom
ci/flatpak-index-deploy-key

Conversation

@hanthor

@hanthor hanthor commented Nov 10, 2026

Copy link
Copy Markdown
Member

The org secret FLATPAK_INDEX_TOKEN (a personal access token used to push the central Flatpak index into tuna-os/docs) has expired: the index push now fails with HTTP 401, so publishes fail. It is replaced by a write deploy key on tuna-os/docs whose private half is the org secret FLATPAK_INDEX_DEPLOY_KEY. tuna-os/.github#360 (4078f531) added an ssh-key input to the shared publish-flatpak-index action and made the reusable publish-flatpak.yml forward FLATPAK_INDEX_DEPLOY_KEY.

What changed

  • publish-flatpak.yml: bump the reusable publish-flatpak.yml pin from fded0603 to 4078f531 (#360). It uses secrets: inherit, so it now gets the deploy key.

Refs tuna-os/.github#360.

FLATPAK_INDEX_TOKEN (PAT) expired; pushes to tuna-os/docs return HTTP 401. Refs tuna-os/.github#360.
@hanthor
hanthor requested a review from KiKaraage as a code owner November 10, 2026 22:49
@tuna-reef-hive

Copy link
Copy Markdown
7bb7e30

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 7bb7e30a4325) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

  • sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
    • .github/workflows/publish-flatpak.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

@hanthor
hanthor merged commit aa41020 into main Nov 10, 2026
2 checks passed
@hanthor
hanthor deleted the ci/flatpak-index-deploy-key branch November 10, 2026 23:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant