Rephl3x/Magent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce isolated beta deployment path
Magent CI/CD / verify (push) Successful in 3m4s
Details
Magent CI/CD / deploy-beta (push) Successful in 1m40s
Details

Browse Source
This commit is contained in:
Assclaw
2026-09-17 22:41:34 +12:00
parent 2525a9eb25
commit 91a950a3b0
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci-cd.yml
-1
View File
@@ -102,6 +102,5 @@ jobs:
env: env:
DEPLOY_HOST: ${{ secrets.PROD_SSH_HOST }} DEPLOY_HOST: ${{ secrets.PROD_SSH_HOST }}
DEPLOY_USER: ${{ secrets.PROD_SSH_USER }} DEPLOY_USER: ${{ secrets.PROD_SSH_USER }}
BETA_DEPLOY_PATH: ${{ secrets.PROD_DEPLOY_PATH }}
DEPLOY_SSH_OPTS: -o StrictHostKeyChecking=yes DEPLOY_SSH_OPTS: -o StrictHostKeyChecking=yes
run: bash scripts/deploy_beta_ams_dev01.sh run: bash scripts/deploy_beta_ams_dev01.sh
README.md
+2 -1
View File
@@ -178,9 +178,10 @@ The existing `PROD_*` names are retained for compatibility, but this workflow us
- `PROD_SSH_PRIVATE_KEY`: private key for the deployment account. - `PROD_SSH_PRIVATE_KEY`: private key for the deployment account.
- `PROD_SSH_HOST`: target host, for example `AMS-DEV01`. - `PROD_SSH_HOST`: target host, for example `AMS-DEV01`.
- `PROD_SSH_USER`: target user, for example `zak`. - `PROD_SSH_USER`: target user, for example `zak`.
- `PROD_DEPLOY_PATH`: beta app path, for example `/home/zak/magent-beta`.
- `PROD_SSH_KNOWN_HOSTS`: required pinned `known_hosts` entry. Deployments reject unknown or changed hosts. - `PROD_SSH_KNOWN_HOSTS`: required pinned `known_hosts` entry. Deployments reject unknown or changed hosts.
Beta always deploys to the isolated `/home/<deployment-user>/magent-beta` directory; the production path secret is intentionally ignored.
## Security and data handling ## Security and data handling
Generate independent signing and settings-encryption secrets before first startup: Generate independent signing and settings-encryption secrets before first startup: