From c1e1442155e7239ce80306a45621517b9b61e428 Mon Sep 17 00:00:00 2001 From: Clint Branham Date: Tue, 24 Mar 2026 09:49:21 -0500 Subject: [PATCH] fix(ci): move PVE_TARGET_NODE from secret to variable The node name "pve" was being masked in all CI logs because GitHub Actions auto-masks secret values. Since the node name is not sensitive, use vars.PVE_TARGET_NODE instead of secrets.PVE_TARGET_NODE. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/integration-tests.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index e99d50c..137f500 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -16,9 +16,11 @@ name: Integration Tests # Required repository secrets (for provisioning): # PVE_ENDPOINT - Parent PVE API URL (e.g. https://pve.example.com:8006) # PVE_API_TOKEN - Parent PVE API token (for Terraform + uploads) -# PVE_TARGET_NODE - Parent PVE node name # PVE_TEST_PASSWORD - Root password for nested PVE instances # +# Required repository variables: +# PVE_TARGET_NODE - Parent PVE node name (variable, not secret, to avoid log masking) +# # Optional secrets (for skip_provision mode): # PVETEST_HOST - Hostname or IP of a pre-existing nested PVE # PVETEST_APITOKEN - API token for the pre-existing nested PVE @@ -121,7 +123,7 @@ jobs: env: PVE_ENDPOINT: ${{ secrets.PVE_ENDPOINT }} PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }} - PVE_TARGET_NODE: ${{ secrets.PVE_TARGET_NODE }} + PVE_TARGET_NODE: ${{ vars.PVE_TARGET_NODE }} PVE_PASSWORD: ${{ secrets.PVE_TEST_PASSWORD }} run: bash ${SCRIPTS_DIR}/run-integration.sh provision @@ -191,7 +193,7 @@ jobs: env: PVE_ENDPOINT: ${{ secrets.PVE_ENDPOINT }} PVE_API_TOKEN: ${{ secrets.PVE_API_TOKEN }} - PVE_TARGET_NODE: ${{ secrets.PVE_TARGET_NODE }} + PVE_TARGET_NODE: ${{ vars.PVE_TARGET_NODE }} run: bash ${SCRIPTS_DIR}/run-integration.sh cleanup # ── Clean up old container images from GHCR ──────────────────────────