way/pigway-frame-flow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 29 Wiki Activity

release: v0.1.20 audit delivery and refresh container security updates
Community checks / verify (push) Skipped
Details
Verify Frame Flow / verify (push) Successful in 5m41s
Details

Browse Source
This commit is contained in:
渡口浪人
2026-10-18 18:48:47 +08:00
parent 5b2763910e
commit 0d691826b6
8 changed files with 260 additions and 210 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PUBLICATION.md
+9 -12
View File
@@ -10,23 +10,20 @@ read-only repository permissions and no deployment configuration. External fork
are not executed on this runner; maintainers must review them before copying changes
to a trusted branch. All lint, type, test, audit and isolated Docker checks remain.
Private deployment configuration is stored in Gitea Actions Secrets:
`PROD_DATA_DIR`, `PROD_CONFIG_DIR`, `PROD_PHOTOS_DIR`, `PROD_WEB_BIND`,
`SYNOLOGY_PHOTOS_URL`, `SYNOLOGY_PHOTOS_CERT_SHA256`, and `PRODUCTION_ENV`.
Project/image names, ports, enable flags and mirror settings remain Variables.
Never print complete Docker inspect environment or secret values.
Public CI verifies source only. Runtime configuration belongs in private environment
files or the deployment system's secret store. Never print complete Docker inspect
environment or secret values.
Publishing requires scanning all refs, removing private historic files, pruning
unreachable remote Git objects and archiving/removing historical Actions logs.
A private original mirror is retained outside the repository. Existing clones must
reclone after the privacy history rewrite; do not merge the original history back.
Before publishing, scan the current source and distribution files for secrets and
private receipts. Keep Git history and existing remote releases. If a real historic
secret is found, revoke it and handle history remediation as a separate operation.
## Private deployment inputs
Do not publish host addresses, workstation paths, disk UUIDs, photo-library counts,
or deployment receipts. Keep receipts and recovery bundles outside the repository
in an owner-only directory. A privacy history rewrite changes existing commit IDs;
existing clones must be replaced instead of merging old history back.
or deployment receipts. Do not include deployment receipts or recovery bundles in published archives. Local
obsolete artifacts may be removed after verification; active runtime configuration,
databases and images must be preserved.
`server-release.py` reads `FRAME_FLOW_ROOT` (default `/srv/frameflow`), requires
`FRAME_FLOW_MOUNT_UUID` and `FRAME_FLOW_ORIGIN`, and retains the mount-identity