fix(docs): pass secrets to the reusable documentation workflow by rubenvdlinde · Pull Request #732 · ConductionNL/stackiq

rubenvdlinde · 2026-08-24T16:10:29Z

The bug

This repo's .github/workflows/documentation.yml calls the reusable workflow
ConductionNL/.github/.github/workflows/documentation.yml@main but never passed
it any secrets.

A called (reusable) workflow receives NO secrets from its caller unless they
are passed explicitly under secrets: or the caller sets secrets: inherit.
with: carries inputs, never secrets, and permissions: governs the token,
not the secrets. So inside the callee secrets.CF_API_TOKEN was always empty.

The consequence is a run that lies:

Deploy to GitHub Pages — success
Publish to the Cloudflare Worker that serves this site — skipped (its own
if: guard on the token)
Warn when Cloudflare credentials are absent — success

Every job green, and the only thing that actually reached the edge was a
gh-pages branch that nothing serves. That is why the fleet docs sites still
serve their pre-rename builds even now that the push triggers are fixed.

Measured on planninq run
32715324775,
whose warn step emitted:

CF_API_TOKEN is not set, so the Cloudflare Worker that actually serves planix.conduction.nl was NOT updated.

The change

One line — secrets: inherit as a sibling of uses: and with: on the deploy
job — plus a comment recording why, so the next reader does not remove it as
noise. No inputs, triggers, or permissions were touched. YAML validated with
yaml.safe_load.

Necessary, not sufficient

This lets the credential reach the callee. It does not create one. No repo in
this set carries a CF_API_TOKEN / CLOUDFLARE_API_TOKEN repo secret, so unless
an organisation-level secret of that name exists and is visible to this repo,
the Worker publish step will still skip after this merges — just for a different
reason. Provisioning that secret is a separate, human decision.

Part of a 12-repo fleet sweep: dossiq, integriq, humaniq, larpinq, decidiq,
buildiq, stackiq, keepiq, versioniq, thematiq, planninq, filinq.

A called workflow receives no secrets from its caller unless they are passed explicitly or inherited. Without `secrets: inherit` the callee sees an empty `secrets.CF_API_TOKEN`, its "Publish to the Cloudflare Worker" step skips itself on its own guard, and the run finishes green having written only gh-pages — which nothing serves. The live docs site never changes and no check goes red to say so. Measured on planninq run 32715324775: all three jobs green, GitHub Pages deploy success, Worker publish skipped, warn step reporting the Worker was not updated.

…g all `secrets: inherit` handed the reusable documentation workflow every secret this repo holds — the Nextcloud signing cert and key, the appstore token, the deploy keys — for the sake of two Cloudflare values. It also would not have worked. The org secrets are CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID and `inherit` passes secrets under their original names, while the callee reads CF_API_TOKEN / CF_ACCOUNT_ID — so the publish step would still have skipped itself and the run would still have gone green over an unchanged live site. Maps the two names explicitly instead, so nothing else crosses the boundary. Depends on ConductionNL/.github#568, which declares both as optional secrets on the callee: an explicit mapping only compiles for names the callee declares.

rubenvdlinde · 2026-08-24T16:26:01Z

Updated to an explicit CF_API_TOKEN / CF_ACCOUNT_ID mapping; nothing else from this repo is handed to the reusable workflow any more. Needs ConductionNL/.github#568 merged first.

github-actions · 2026-08-24T16:39:05Z

Quality Report — ConductionNL/stackiq @ `9f0de71`

Check	PHP	Vue	Security	License	Tests
lint	⏭️
phpcs	⏭️
phpmd	⏭️
psalm	⏭️
phpstan	⏭️
phpmetrics	⏭️
eslint		⏭️
stylelint		⏭️
build		⏭️
composer			⏭️	⏭️
npm			⏭️	⏭️
app:check-code	⏭️
info.xml	⏭️
REUSE	⏭️
PHPUnit					❌
Newman					❌
Playwright					❌
Hydra gates					❌

Quality workflow — 2026-08-24 16:39 UTC

Download the full PDF report from the workflow artifacts.

github-actions · 2026-08-24T17:53:27Z

Quality Report — ConductionNL/stackiq @ `8d2c218`

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 130/130
npm			✅	✅ 720/720
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					✅

Quality workflow — 2026-08-24 17:53 UTC

Download the full PDF report from the workflow artifacts.

…it-secrets

This branch introduced the mapping reading `secrets.CLOUDFLARE_API_TOKEN` / `secrets.CLOUDFLARE_ACCOUNT_ID`, which are not secrets anywhere in this org. Mapping from a non-existent secret is not an error - it yields an empty string - so the callee`s "Publish to the Cloudflare Worker" step would have skipped itself on its own guard and the run would still have gone green, exactly the failure this PR set out to fix. Caught before merge; measured on planninq run 32760529026, where the same spelling did land. The real org secrets are CF_API_TOKEN / CF_ACCOUNT_ID, the same names the callee declares and the same ones ConductionNL/.github deploy-docs.yml reads directly. Only the mapping values change; the keys stay. The comment claimed the names differ on each side. They do not, and that claim is what produced the wrong values. Replaced with the reason that still holds: `secrets: inherit` would hand the callee every secret this repo holds for the sake of two Cloudflare values.

rubenvdlinde · 2026-08-24T20:21:21Z

Pushed a correction onto this branch (b4b2b59) before it merges.

The mapping this PR introduced read from secrets that do not exist:

      CF_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      CF_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID are not secrets anywhere in this org. Mapping from a non-existent secret is not an error — it yields an empty string. So this PR would have merged, gone green, and left Publish to the Cloudflare Worker skipping itself on its own if: env.CF_API_TOKEN != '' guard: exactly the failure it was opened to fix.

That is not a prediction. The same spelling merged on planninq and was measured on run 32760529026 — Worker publish SKIPPED, log showing CF_API_TOKEN: with no value.

The real org secrets are CF_API_TOKEN / CF_ACCOUNT_ID — the same names the callee declares under workflow_call.secrets, and the same ones ConductionNL/.github's own deploy-docs.yml reads directly (secrets.CF_API_TOKEN). Documented in ConductionNL/conduction-website .github/workflows/deploy.yml on development, lines 11-16.

Only the mapping values change; the keys stay. The comment paragraph claiming "the names also differ on each side (org CLOUDFLARE_*, callee CF_*)" — the reasoning that produced the wrong values — has been replaced with the reason that does still hold: secrets: inherit would hand the callee every secret this repo holds for the sake of two Cloudflare values.

The other eleven fleet repos, where this spelling had already merged to development, are fixed in their own fix/cloudflare-secret-names PRs. stackiq is the only one where it was caught pre-merge, which is why it is a commit here instead of a second PR.

github-actions · 2026-08-24T20:36:43Z

Quality Report — ConductionNL/stackiq @ `403c721`

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 130/130
npm			✅	✅ 720/720
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					❌
Newman					⏭️
Playwright					❌
Hydra gates					❌

Quality workflow — 2026-08-24 20:36 UTC

Download the full PDF report from the workflow artifacts.

github-actions · 2026-08-24T21:56:31Z

Quality Report — ConductionNL/stackiq @ `c577f71`

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 130/130
npm			✅	✅ 720/720
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

Quality workflow — 2026-08-24 21:56 UTC

Download the full PDF report from the workflow artifacts.

rubenvdlinde added 2 commits August 24, 2026 18:09

rubenvdlinde added 2 commits August 24, 2026 22:09

Merge remote-tracking branch 'origin/development' into fix/docs-inher…

17ce2bb

…it-secrets

rubenvdlinde merged commit 9ae12cf into development Aug 24, 2026
86 checks passed

rubenvdlinde deleted the fix/docs-inherit-secrets branch August 24, 2026 21:51

Navigation Menu

Uh oh!

fix(docs): pass secrets to the reusable documentation workflow - #732

fix(docs): pass secrets to the reusable documentation workflow#732
rubenvdlinde merged 4 commits into
developmentfrom
fix/docs-inherit-secrets

rubenvdlinde commented Aug 24, 2026

Uh oh!

rubenvdlinde commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

rubenvdlinde commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

rubenvdlinde commented Aug 24, 2026

The bug

The change

Necessary, not sufficient

Uh oh!

rubenvdlinde commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Quality Report — ConductionNL/stackiq @ 9f0de71

Uh oh!

github-actions Bot commented Aug 24, 2026

Quality Report — ConductionNL/stackiq @ 8d2c218

Uh oh!

rubenvdlinde commented Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Quality Report — ConductionNL/stackiq @ 403c721

Uh oh!

Uh oh!

github-actions Bot commented Aug 24, 2026

Quality Report — ConductionNL/stackiq @ c577f71

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Quality Report — ConductionNL/stackiq @ `9f0de71`

Quality Report — ConductionNL/stackiq @ `8d2c218`

Quality Report — ConductionNL/stackiq @ `403c721`

Quality Report — ConductionNL/stackiq @ `c577f71`