fix(ci): base64-encode the bot GPG key secret #147

Merged
rootiest merged 2 commits from fix/ci-gpg-key-base64 into main 2026-09-10 04:00:26 +00:00
3 changed files with 24 additions and 6 deletions
+8 -2
View File
@@ -135,15 +135,21 @@ jobs:
# of server config. fishconfig-bot is a dedicated Gitea account # of server config. fishconfig-bot is a dedicated Gitea account
# (verified email, no login) that owns this key; the private # (verified email, no login) that owns this key; the private
# key lives only in the CI_GPG_PRIVATE_KEY repo secret. # key lives only in the CI_GPG_PRIVATE_KEY repo secret.
#
# Secret is base64-encoded: a raw multi-line armored key piped
# through `echo "$VAR" | gpg --import` came out CRC-corrupted
# ("Invalid keyring") the first time this ran -- something in
# the secret/env round-trip mangles embedded newlines. Base64
# collapses it to one line immune to that.
export GNUPGHOME="$(mktemp -d)" export GNUPGHOME="$(mktemp -d)"
chmod 700 "$GNUPGHOME" chmod 700 "$GNUPGHOME"
echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf" echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf"
echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf" echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf"
command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg
echo "$BOT_GPG_KEY" | gpg --batch --import echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --import
git config user.name "Gitea Actions Bot" git config user.name "Gitea Actions Bot"
git config user.email "fishconfig-bot@git.rootiest.dev" git config user.email "fishconfig-bot@git.rootiest.dev"
git config user.signingkey 0603CD87750C18FB3604147EFD08763FA41E5534 git config user.signingkey CAA082C2F3467E1F7217AD492075C120312D23F4
git config commit.gpgsign true git config commit.gpgsign true
git add docs/fish-config.md docs/fish-config.1 conf.d/__fish_config_op_registry.fish git add docs/fish-config.md docs/fish-config.1 conf.d/__fish_config_op_registry.fish
git diff --cached --quiet && echo "No changes to commit" && exit 0 git diff --cached --quiet && echo "No changes to commit" && exit 0
+8 -2
View File
@@ -2877,14 +2877,19 @@ no session-end hook, so its memory is captured on the next launch
rather than at session end. rather than at session end.
Arguments are forwarded verbatim to the real agy binary, except for Arguments are forwarded verbatim to the real agy binary, except for
-r/--resume which are translated to -c/--continue. -r/--resume which use different syntax in agy than claude: bare
-r/--resume (no session id following) translate to -c/--continue
(resume most-recent session); -r/--resume given a session id (via
=id or a following bare word) translate to --conversation(=id)
(open that specific session).
Opinionated component (C1): when disabled via __fish_config_op_aliases Opinionated component (C1): when disabled via __fish_config_op_aliases
(or the __fish_config_opinionated master), the command is passed through (or the __fish_config_opinionated master), the command is passed through
to the real agy binary unchanged. to the real agy binary unchanged.
Arguments: Arguments:
ARGS Arguments forwarded to the underlying agy binary (-r translates to -c) ARGS Arguments forwarded to the underlying agy binary (-r/--resume
translate to -c/--continue or --conversation, see DESCRIPTION)
Exit Status: Exit Status:
Exit status of the underlying agy binary Exit status of the underlying agy binary
@@ -2892,6 +2897,7 @@ Exit Status:
Example: Example:
agy agy
agy --resume agy --resume
agy --resume=5fffb251-2cd6-4cfe-8dac-b5e913a86db6
agy -i \[dq]initial prompt\[dq] agy -i \[dq]initial prompt\[dq]
agy models agy models
\f[R] \f[R]
+8 -2
View File
@@ -2346,14 +2346,19 @@ functions). They are active in all interactive sessions.
rather than at session end. rather than at session end.
Arguments are forwarded verbatim to the real agy binary, except for Arguments are forwarded verbatim to the real agy binary, except for
-r/--resume which are translated to -c/--continue. -r/--resume which use different syntax in agy than claude: bare
-r/--resume (no session id following) translate to -c/--continue
(resume most-recent session); -r/--resume given a session id (via
=id or a following bare word) translate to --conversation(=id)
(open that specific session).
Opinionated component (C1): when disabled via __fish_config_op_aliases Opinionated component (C1): when disabled via __fish_config_op_aliases
(or the __fish_config_opinionated master), the command is passed through (or the __fish_config_opinionated master), the command is passed through
to the real agy binary unchanged. to the real agy binary unchanged.
Arguments: Arguments:
ARGS Arguments forwarded to the underlying agy binary (-r translates to -c) ARGS Arguments forwarded to the underlying agy binary (-r/--resume
translate to -c/--continue or --conversation, see DESCRIPTION)
Exit Status: Exit Status:
Exit status of the underlying agy binary Exit status of the underlying agy binary
@@ -2361,6 +2366,7 @@ functions). They are active in all interactive sessions.
Example: Example:
agy agy
agy --resume agy --resume
agy --resume=5fffb251-2cd6-4cfe-8dac-b5e913a86db6
agy -i "initial prompt" agy -i "initial prompt"
agy models agy models