Forges and signing
yasrt detects the forge from the job environment and needs only the job token there. The signing key is the only optional long-lived secret; both are masked in every log line, in error messages and in the run report.
- GitLab:
CI_JOB_TOKEN, uploads to the generic package registry, pipeline triggers - GitHub:
GITHUB_TOKEN, uploads attached to the release - Forgejo:
FORGEJO_TOKEN, detected before GitHub;giteais a synonym
The three forges
| GitLab | GitHub | Forgejo | |
|---|---|---|---|
| detected by | GITLAB_CI | GITHUB_ACTIONS on github.com | FORGEJO_ACTIONS, or GITHUB_SERVER_URL elsewhere |
| token | CI_JOB_TOKEN | GITHUB_TOKEN | FORGEJO_TOKEN or GITHUB_TOKEN |
release links (assets[].url) | attached to the release | listed in the release text | listed in the release text |
uploads (assets[].path) | generic package registry, linked from the release | attached to the release | attached to the release |
after_release.triggers | pipeline trigger API | not available; reported per trigger, exit stays 0 | as GitHub |
yasrt check: permission probe | compares branch and tag protection | not probed | not probed |
Forgejo is detected before GitHub because its runner sets the GITHUB_* variables for compatibility; a naive check would send a Forgejo token to api.github.com. gitea is accepted as a synonym for forgejo.
Signing
release_commit.sign takes auto (sign when a key is present), required (fail before anything is written when none is) or off. The key comes from GPG_SEM_REL_B64 (the variable name is configurable) and may be an OpenPGP or an OpenSSH private key, base64-encoded; yasrt tells which from the material. Both live in a private temporary directory for the duration of the run and are removed afterwards; all three forges verify SSH signatures.
Both paths are tested: with actually generated keys, and the resulting tag and commit are checked with git verify-tag / git verify-commit.
Security
The only access required is the job token, read from the environment and handed to git through a credential helper, never in a URL or an argument list. The signing key is the only optional long-lived secret. Both are masked in every log line, in error messages and in the run report. Report vulnerabilities as SECURITY.md in the repository describes.
Where it lives
The public home is github.com/ohartwig/yasrt; that is the module path, and tags and releases appear there. Development and the release pipeline run on my GitLab, which mirrors there: merge requests there, issues and pull requests on GitHub are both read.
Next
CI pipelines
Installation, the three-stage GitLab pipeline, GitHub Actions and Forgejo Actions.