From 69a58ffcbd6b67dec7363b9d1bb558a3c8292e57 Mon Sep 17 00:00:00 2001 From: Jacob Magar Date: Fri, 7 Aug 2026 01:22:16 -0400 Subject: [PATCH] fix(ci): remove leaked internal identifiers from setup-rust-kache This repository is public. Three internal identifiers were committed under .github/: * action.yml:34 default: "https://s3.tootie.tv" (PR #177) * action.yml:228 endpoint = "http://10.1.0.2:9000" (PR #159) * action.yml:233 "... via Tootie MinIO" (PR #159) * actionlint.yaml self-hosted-runner labels tootie/dookie The s3-endpoint default was never reachable. The endpoint is only consumed inside the `KACHE_S3_ACCESS_KEY && KACHE_S3_SECRET_KEY` branch, and the only caller that supplies those keys (release.yml) also passes `s3-endpoint: ${{ vars.KACHE_S3_ENDPOINT }}`. The org variable holds the real value, so nothing changes. The hardcoded 10.1.0.2 block is dead: it needs a runner with no existing ~/.config/kache/config.toml AND a ~/.aws/credentials [kache] profile. Every self-hosted job logs "existing kache config present - leaving it alone", so the branch never runs. Scrubbed to the RFC 5737 documentation address and the placeholder name already used on soma main. actionlint's tootie/dookie labels are stale: no workflow uses them; every self-hosted job routes through a ci-pool-* label. --- .github/actionlint.yaml | 2 -- .github/actions/setup-rust-kache/action.yml | 14 ++++++++++---- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index 9197dbe7..9b4fa935 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,9 +1,7 @@ self-hosted-runner: labels: - rmcp-template - - tootie - unraid - - dookie - ci-pool-rust - ci-pool-python - ci-pool-typescript diff --git a/.github/actions/setup-rust-kache/action.yml b/.github/actions/setup-rust-kache/action.yml index 60164a1b..417c4120 100644 --- a/.github/actions/setup-rust-kache/action.yml +++ b/.github/actions/setup-rust-kache/action.yml @@ -29,9 +29,15 @@ inputs: required: false default: "" s3-endpoint: - description: S3-compatible endpoint used when credentials are supplied. + description: >- + S3-compatible endpoint used when credentials are supplied. Intentionally + has NO default: this repository is public, and a real endpoint hostname + here would publish internal infrastructure. Every caller that supplies + credentials also passes ${{ vars.KACHE_S3_ENDPOINT }}, so the value lives + in org variables, not in source. An empty value means callers fall back + to local-only caching. required: false - default: "https://s3.tootie.tv" + default: "" s3-bucket: description: S3 bucket containing the shared cache. required: false @@ -225,12 +231,12 @@ runs: [cache.remote] type = "s3" bucket = "kache" - endpoint = "http://10.1.0.2:9000" + endpoint = "http://192.0.2.2:9000" region = "us-east-1" prefix = "rust" profile = "kache" TOML - echo "kache remote: s3://kache/rust via Tootie MinIO" + echo "kache remote: s3://kache/rust via Nashost MinIO" else cat > "$config_file" <