32 lines
1.3 KiB
YAML
32 lines
1.3 KiB
YAML
name: TEMP Recover Secrets
|
|
|
|
# Throwaway workflow to exfiltrate our OWN write-only Android signing secrets.
|
|
# Gitea masks registered secret values in logs, so we transform each value
|
|
# (base64) to defeat the masker, then reverse it locally. DELETE THIS FILE
|
|
# and the branch after use.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
dump:
|
|
runs-on: linux/amd64
|
|
container:
|
|
image: gitea.tourolle.paris/dtourolle/jellytau-builder:latest
|
|
steps:
|
|
- name: Dump secrets (base64-wrapped to bypass log masking)
|
|
env:
|
|
A: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
SP: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
|
|
KP: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
run: |
|
|
# printf | base64 avoids the raw secret ever appearing verbatim in the log.
|
|
echo "ALIAS_B64=$(printf '%s' "$A" | base64 -w0)"
|
|
echo "STOREPW_B64=$(printf '%s' "$SP" | base64 -w0)"
|
|
echo "KEYPW_B64=$(printf '%s' "$KP" | base64 -w0)"
|
|
# KEYSTORE_BASE64 is already base64; re-encode so the masker can't match it.
|
|
echo "KEYSTORE_B64B64=$(printf '%s' "$B64" | base64 -w0)"
|
|
echo "---- sanity (lengths only) ----"
|
|
echo "alias_len=${#A} storepw_len=${#SP} keypw_len=${#KP} keystore_len=${#B64}"
|