Provision the NWSync write credential on the two emitter repos #74

New Issue

2026-07-30T19:57:23Z

archvillainette commented

2026-07-30 19:57:23 +00:00

Question

Part of #54.

emit uploads to the NWSync zone from sow-assets-manifest (12 haks, at pack time) and sow-topdata (sow_top.hak and the TLK, at publish time). Neither repo can reach that zone today — verified against Actions secrets, both hold only BUNNY_STORAGE_ZONE and BUNNY_STORAGE_PASSWORD, the depot pair. sow-module already has NWSYNC_STORAGE_ZONE / NWSYNC_STORAGE_PASSWORD (#61); the emitters do not.

Nothing to decide about whether — #61 settled that a zone-wide write key to the separate NWSync zone is the acceptable grant, and the emitters need exactly the same one. This is the doing.

Add NWSYNC_STORAGE_ZONE and NWSYNC_STORAGE_PASSWORD to both repos' Actions secrets, same zone as sow-module uses.
Pass BUNNY_STORAGE_HOST in all three repos' workflow steps that invoke crucible-nwsync: Crucible has no default host (internal/depot/config.go:42) while every repo's depot-lib.sh does, so it must be handed over explicitly (#65).
Confirm each repo's release workflow fails loudly on an unset key rather than skipping the upload — sow-module's existing depot guard (release.yml:51-53) is the pattern to copy.

Requires the Bunny dashboard, so a human runs the secret half; the workflow half is a normal change.

## Question Part of #54. `emit` uploads to the NWSync zone from `sow-assets-manifest` (12 haks, at pack time) and `sow-topdata` (`sow_top.hak` and the TLK, at publish time). Neither repo can reach that zone today — verified against Actions secrets, both hold only `BUNNY_STORAGE_ZONE` and `BUNNY_STORAGE_PASSWORD`, the depot pair. `sow-module` already has `NWSYNC_STORAGE_ZONE` / `NWSYNC_STORAGE_PASSWORD` (#61); the emitters do not. Nothing to decide about *whether* — #61 settled that a zone-wide write key to the separate NWSync zone is the acceptable grant, and the emitters need exactly the same one. This is the doing. - Add `NWSYNC_STORAGE_ZONE` and `NWSYNC_STORAGE_PASSWORD` to both repos' Actions secrets, same zone as `sow-module` uses. - Pass `BUNNY_STORAGE_HOST` in all three repos' workflow steps that invoke `crucible-nwsync`: Crucible has no default host (`internal/depot/config.go:42`) while every repo's `depot-lib.sh` does, so it must be handed over explicitly (#65). - Confirm each repo's release workflow fails loudly on an unset key rather than skipping the upload — `sow-module`'s existing depot guard (`release.yml:51-53`) is the pattern to copy. Requires the Bunny dashboard, so a human runs the secret half; the workflow half is a normal change.

archvillainette added the wayfinder:task label 2026-07-30 19:57:23 +00:00

archvillainette self-assigned this 2026-07-30 20:40:14 +00:00

archvillainette commented

2026-07-30 21:55:16 +00:00

Done — provisioned org-wide, not per repo.

NWSYNC_STORAGE_ZONE and NWSYNC_STORAGE_PASSWORD now live as ShadowsOverWestgate organisation Actions secrets (created 2026-07-30), alongside BUNNY_STORAGE_ZONE / BUNNY_STORAGE_PASSWORD / BUNNY_API_KEY, which moved up the same way — the depot pair had been duplicated across repos. The per-repo copies were deprovisioned: sow-module and sow-assets-manifest now hold no repo secrets at all, sow-topdata holds only NODEBB_API_TOKEN. Org secrets are inherited by every repo's Actions runs, so \${{ secrets.NWSYNC_STORAGE_* }} resolves in all three emitters with no workflow change and no further grant.

This widens #61's grant slightly — the NWSync write key is now reachable from any repo in the org, not just the three that need it. Accepted on #61's own reasoning: the zone contains only regenerable data, no secrets and no player data, and it stays a separate zone from the assets depot. BUNNY_API_KEY (the account key) moving org-wide is the larger of the two widenings and rides on the same call.

The other two bullets have no target yet and are deferred, not done:

Pass BUNNY_STORAGE_HOST — nothing to pass it to. grep across sow-module, sow-assets-manifest and sow-topdata finds zero crucible-nwsync references in any workflow or script; #65 wired the repos as issue text only. Also note the host is not a secret: it is a literal in the workflow (sow-assets-manifest/.gitea/workflows/release.yml:41, publish-haks.yml:43 = storage.bunnycdn.com) and defaults in every depot-lib.sh (sow-module/scripts/depot-lib.sh:13). The new nwsync step just sets the same literal env.
Fail loudly on an unset key — likewise no upload step to guard. Pattern to copy when it is written: sow-module/.gitea/workflows/release.yml:51-53, a [[ -z \"\${VAR:-}\" ]] check with exit 1 before the publish runs.

Both belong to the wiring change that adds the emit steps (sow-assets-manifest#48, sow-topdata#178, sow-module#51), where the step and its guard are written together. Credentials are no longer what blocks that work.

Done — provisioned **org-wide**, not per repo. `NWSYNC_STORAGE_ZONE` and `NWSYNC_STORAGE_PASSWORD` now live as ShadowsOverWestgate **organisation** Actions secrets (created 2026-07-30), alongside `BUNNY_STORAGE_ZONE` / `BUNNY_STORAGE_PASSWORD` / `BUNNY_API_KEY`, which moved up the same way — the depot pair had been duplicated across repos. The per-repo copies were deprovisioned: sow-module and sow-assets-manifest now hold no repo secrets at all, sow-topdata holds only `NODEBB_API_TOKEN`. Org secrets are inherited by every repo's Actions runs, so `\${{ secrets.NWSYNC_STORAGE_* }}` resolves in all three emitters with no workflow change and no further grant. This widens #61's grant slightly — the NWSync write key is now reachable from any repo in the org, not just the three that need it. Accepted on #61's own reasoning: the zone contains only regenerable data, no secrets and no player data, and it stays a separate zone from the assets depot. `BUNNY_API_KEY` (the account key) moving org-wide is the larger of the two widenings and rides on the same call. **The other two bullets have no target yet and are deferred, not done:** - *Pass `BUNNY_STORAGE_HOST`* — nothing to pass it to. grep across sow-module, sow-assets-manifest and sow-topdata finds zero `crucible-nwsync` references in any workflow or script; #65 wired the repos as issue text only. Also note the host is **not a secret**: it is a literal in the workflow (`sow-assets-manifest/.gitea/workflows/release.yml:41`, `publish-haks.yml:43` = `storage.bunnycdn.com`) and defaults in every `depot-lib.sh` (`sow-module/scripts/depot-lib.sh:13`). The new nwsync step just sets the same literal env. - *Fail loudly on an unset key* — likewise no upload step to guard. Pattern to copy when it is written: `sow-module/.gitea/workflows/release.yml:51-53`, a `[[ -z \"\${VAR:-}\" ]]` check with `exit 1` before the publish runs. Both belong to the wiring change that adds the emit steps (sow-assets-manifest#48, sow-topdata#178, sow-module#51), where the step and its guard are written together. Credentials are no longer what blocks that work.

archvillainette closed this issue

2026-07-30 21:55:17 +00:00

archvillainette referenced this issue

2026-07-30 21:55:35 +00:00

Map: NWSync publishing — emit at artifact birth, assemble at module release #54

archvillainette referenced this issue

2026-07-31 16:12:53 +00:00

Map: NWSync publishing — emit at artifact birth, assemble at module release #54

Sign in to join this conversation.