From 22b4db6ba165df472cb390e16316ec4d203a9007 Mon Sep 17 00:00:00 2001 From: debuggingfuture Date: Fri, 16 Oct 2026 17:56:47 +0800 Subject: [PATCH] ci(deploy): state the token scope without the deploying account's identifiers --- .github/workflows/deploy.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index e5b10b94..6accec71 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -16,10 +16,9 @@ name: deploy # `workflow_dispatch` with `target: substrate` stops after the canary, so a # security patch to the substrate never queues behind a product release. # -# CREDENTIALS. `CLOUDFLARE_API_TOKEN` — account-scoped to FractalBox -# (c91d52c2…), no zone resources: Workers Scripts:Edit, Workers KV:Edit, -# Workers R2:Edit, D1:Edit, Containers:Edit, Account Settings:Read. -# Created 2026-08-06 · dash.cloudflare.com/profile/api-tokens · no expiry. +# CREDENTIALS. `CLOUDFLARE_API_TOKEN` — scoped to the deploying org's account, +# no zone resources: Workers Scripts:Edit, Workers KV:Edit, Workers R2:Edit, +# D1:Edit, Containers:Edit, Account Settings:Read. # Scope is recorded here because GitHub secrets have no comment field and a # Cloudflare token cannot report its own policies — reading them needs a # *second* token with API Tokens:Read, so an undocumented token's grants are