gitmote / .env.example · history · branches
1041 bytes · raw
# Break-glass self-deploy secrets (`make self-deploy`). Copy to .env (gitignored)
# and fill in. These are injected into the deploy workflow as ${{ secrets.NAME }},
# seeded per-repo for the `gitmote` repo via the GITMOTE_REPO_SECRET_<REPO>__<NAME>
# convention (repo uppercased: gitmote → GITMOTE). Never stored, never encrypted —
# the host env is the trust boundary (docs/architecture/safety.md §7).
# Scaleway API credentials that deploy the container (the same five the GitHub
# pipeline uses). The access key starts with SCW…; the secret key is a UUID.
GITMOTE_REPO_SECRET_GITMOTE__SCW_SECRET_KEY=
GITMOTE_REPO_SECRET_GITMOTE__SCW_ACCESS_KEY=
GITMOTE_REPO_SECRET_GITMOTE__SCW_ORGANIZATION_ID=
GITMOTE_REPO_SECRET_GITMOTE__SCW_PROJECT_ID=
GITMOTE_REPO_SECRET_GITMOTE__SCW_CONTAINER_ID=
# GHCR push credentials — a PAT with write:packages (GitHub uses its built-in
# GITHUB_TOKEN, which doesn't exist off GitHub, so the local path needs a PAT).
GITMOTE_REPO_SECRET_GITMOTE__GHCR_USER=
GITMOTE_REPO_SECRET_GITMOTE__GHCR_TOKEN=