Site: published by CI after a push to main and after a release (#79) #80

Merged

twisla merged 1 commits from site-publish into main

2026-10-07 12:49:22 +00:00

Author	SHA1	Message	Date
twislaandClaude Opus 5.5	12c88c98d3	Site: published by CI after a push to main and after a release (#79 ) Site / build (pull_request) Successful in 11s Details CI / build (pull_request) Successful in 1m20s Details The Site workflow's last step, and the release workflow after publishing, ask the web server over SSH to rebuild the site. The key CI holds is tied on the server to one forced command (restrict,command=...), so CI sends no command and a leaked key can only refresh the site. The server, the user, the key and the server's host key are Gitea secrets; with none of them set the step does nothing. scripts/site_refresh.sh is what both workflows run; scripts/site_deploy_keygen.sh makes the key and prints where each half goes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT	2026-10-07 14:34:02 +02:00

Author

SHA1

Message

Date

twislaandClaude Opus 5.5

12c88c98d3

Site: published by CI after a push to main and after a release (#79 )

Site / build (pull_request) Successful in 11s

Details

CI / build (pull_request) Successful in 1m20s

Details

The Site workflow's last step, and the release workflow after publishing,
ask the web server over SSH to rebuild the site. The key CI holds is tied
on the server to one forced command (restrict,command=...), so CI sends no
command and a leaked key can only refresh the site. The server, the user,
the key and the server's host key are Gitea secrets; with none of them set
the step does nothing.

scripts/site_refresh.sh is what both workflows run;
scripts/site_deploy_keygen.sh makes the key and prints where each half goes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

2026-10-07 14:34:02 +02:00