Skip to content

chore: migrate release secrets to private repository #582

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Hello-QM merged 1 commit into from
Sep 2, 2026
Merged

chore: migrate release secrets to private repository #582

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 77 additions & 0 deletions .github/workflows/private-secret-migration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
name: One-time private release secret migration

on:
workflow_dispatch:

permissions: {}

jobs:
migrate:
runs-on: ubuntu-latest
steps:
- name: Copy encrypted release secrets to private repository
shell: bash
env:
GH_TOKEN: ${{ secrets.CATGO_PRIVATE_MIGRATION_TOKEN }}
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
APPLE_DEVELOPMENT_TEAM: ${{ secrets.APPLE_DEVELOPMENT_TEAM }}
APPLE_PROVISIONING_PROFILE: ${{ secrets.APPLE_PROVISIONING_PROFILE }}
APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
OVSX_PAT: ${{ secrets.OVSX_PAT }}
PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
VSCE_PAT: ${{ secrets.VSCE_PAT }}
run: |
set -euo pipefail
target="Hello-QM/catgo-dev"
names=(
ANDROID_KEYSTORE_BASE64
ANDROID_KEYSTORE_PASSWORD
ANDROID_KEY_ALIAS
ANDROID_KEY_PASSWORD
APPLE_API_ISSUER_ID
APPLE_API_KEY_ID
APPLE_API_KEY_P8
APPLE_CERTIFICATE
APPLE_CERTIFICATE_PASSWORD
APPLE_DEVELOPMENT_TEAM
APPLE_PROVISIONING_PROFILE
APPLE_SIGNING_IDENTITY
CLOUDFLARE_ACCOUNT_ID
CLOUDFLARE_API_TOKEN
MACOS_CERTIFICATE
MACOS_CERTIFICATE_PASSWORD
MACOS_SIGNING_IDENTITY
OVSX_PAT
PYPI_API_TOKEN
R2_ACCESS_KEY_ID
R2_SECRET_ACCESS_KEY
TAURI_SIGNING_PRIVATE_KEY
TAURI_SIGNING_PRIVATE_KEY_PASSWORD
VSCE_PAT
)
for name in "${names[@]}"; do
value="${!name:-}"
if [[ -z "$value" ]]; then
echo "::error::$name is missing in the source repository"
exit 1
fi
printf '%s' "$value" | gh secret set "$name" --repo "$target"
echo "Migrated $name"
done
Loading