From 38e76ff56dde297dadfd3e938e4999e75a2a501e Mon Sep 17 00:00:00 2001 From: Mikkeli Matlock Date: Wed, 10 Jun 2026 09:38:27 +0900 Subject: [PATCH 1/2] docs: remove plaintext bot secret, update runner image references MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Credentials moved to Gitea user-scope vault — removed from README. Architecture diagram and songs pipeline deps section updated to reflect prebuilt novoyuuparosk-wiki-runner:latest image (no runtime dep installs). Noted workflow stubs in .gitea/workflows/ may be stale. Co-Authored-By: Claude Sonnet 4.6 --- README.md | 11 ++++------- pipelines/songs/README.md | 6 +++--- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 20e42a0..7e0d136 100644 --- a/README.md +++ b/README.md @@ -16,10 +16,10 @@ Hybrid layout. The Gitea Actions trigger must live in the source repo (Gitea onl ``` / - .gitea/workflows/.yml <- workflow: installs deps, clones this repo, runs renderer + .gitea/workflows/.yml <- workflow: clones this repo, runs renderer (deps pre-baked in job image) novoyuuparosk-auto-wiki/ <- this repo - .gitea/workflows/.yml <- reusable workflow stubs (kept for reference; not actively called) + .gitea/workflows/.yml <- reusable workflow stubs (kept for reference; not actively called; may be stale) pipelines// <- per-pipeline code, schema, templates lib/ <- shared modules (MediaWiki client, etc.) ``` @@ -33,12 +33,9 @@ Note: `workflow_call` across private repos was abandoned — the auto-generated ## Bot identity -MediaWiki BotPassword issued for user `Dubrowski`, bot name `giteaAutomaton`. +MediaWiki BotPassword issued for user `Dubrowski`, bot name `giteaAutomaton`. Login form: `Dubrowski@giteaAutomaton`. -Login as `Dubrowski@giteaAutomaton` with password `d8jua48t65jgjp3dfcqhfg7257tri6ui`. -(Legacy form: username `Dubrowski`, password `giteaAutomaton@d8jua48t65jgjp3dfcqhfg7257tri6ui`.) - -Plaintext here is acceptable for the current phase (private repo, home-Pi LAN-only Gitea). Rotate before any of those preconditions change. Note that `git log` retains this string forever, so rotation requires a wiki-side BotPassword regeneration regardless of what happens to this file. +Credentials are stored in the Gitea user-scope secret vault under `mikkeli` (`WIKI_BOT_USER`, `WIKI_BOT_PASSWORD`). Not stored in this repo. ## Runner infrastructure diff --git a/pipelines/songs/README.md b/pipelines/songs/README.md index 6c831cf..94be2e8 100644 --- a/pipelines/songs/README.md +++ b/pipelines/songs/README.md @@ -58,9 +58,9 @@ Triggers: ## Dependencies -- Python 3.12+ (job container: `python:3.12-slim`) -- Pandoc (apt-installed in the job container) -- `python-frontmatter`, `mwclient`, `PyYAML` — see `requirements.txt` +Job container: `novoyuuparosk-wiki-runner:latest` (pre-built, stored in the local Docker daemon on the runner host). Bakes in Python 3.12, Pandoc, and all pipeline Python packages — no install steps at job runtime. + +See the `Dockerfile` at the repo root and `requirements.txt` in this directory. Rebuild the image after changes to either. ## Modes From f135906392b71c355c24da4946f00ea5cf784914 Mon Sep 17 00:00:00 2001 From: Mikkeli Matlock Date: Wed, 10 Jun 2026 09:40:01 +0900 Subject: [PATCH 2/2] chore: update workflow stub to use prebuilt runner image Switch from python:3.12-slim + apt/pip installs to novoyuuparosk-wiki-runner:latest. Removes the two install steps. Co-Authored-By: Claude Sonnet 4.6 --- .gitea/workflows/publish-songs.yml | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/.gitea/workflows/publish-songs.yml b/.gitea/workflows/publish-songs.yml index b0f145c..d1ffebc 100644 --- a/.gitea/workflows/publish-songs.yml +++ b/.gitea/workflows/publish-songs.yml @@ -19,14 +19,9 @@ jobs: publish: runs-on: ubuntu-latest container: - image: python:3.12-slim + image: novoyuuparosk-wiki-runner:latest steps: - - name: Install system deps - run: | - apt-get update -qq - apt-get install -y --no-install-recommends git pandoc ca-certificates - - name: Checkout ncmr-songs env: FAPAT: ${{ secrets.FAPAT }} @@ -41,9 +36,6 @@ jobs: URL_TO_GITEA: ${{ vars.URL_TO_GITEA }} run: git clone "http://mikkeli:${FAPAT}@${URL_TO_GITEA#http://}/mikkeli/novoyuuparosk-auto-wiki" auto-wiki - - name: Install Python deps - run: pip install --no-cache-dir -r auto-wiki/pipelines/songs/requirements.txt - - name: Detect changed files id: diff run: |