From e07807d7a07d9449bd2327f9228301f610add786 Mon Sep 17 00:00:00 2001 From: Lucio Date: Sun, 19 Jul 2026 23:27:56 +0200 Subject: [PATCH 1/4] CI key hardening --- .github/workflows/pr-build.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml index 4db4187..81461a6 100644 --- a/.github/workflows/pr-build.yml +++ b/.github/workflows/pr-build.yml @@ -35,7 +35,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: Bespok3d/b3-builder@main + - uses: Bespok3d/b3-builder@66509afcc88b13f911e252ebede80ac04c13f6bd # main @ 2026-07-19 with: unit: repo bake: 'true' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 604eab8..9b40431 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -27,7 +27,7 @@ jobs: with: fetch-depth: 0 # full history so the index.json push can rebase on a concurrent update - - uses: Bespok3d/b3-builder@main + - uses: Bespok3d/b3-builder@66509afcc88b13f911e252ebede80ac04c13f6bd # main @ 2026-07-19 with: unit: repo bake: 'true' From 16a2d46627bfc96dc5854d64bae59a3bf54de9d6 Mon Sep 17 00:00:00 2001 From: Lucio Date: Mon, 20 Jul 2026 21:37:01 +0200 Subject: [PATCH 2/4] activating gpp signing --- .github/workflows/release.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9b40431..c17c85f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,6 +30,9 @@ jobs: - uses: Bespok3d/b3-builder@66509afcc88b13f911e252ebede80ac04c13f6bd # main @ 2026-07-19 with: unit: repo + # Per-repo Actions secret today (GitHub Free cannot org-secret private repos); becomes ONE org + # secret every repo inherits when the repos go public. See b3-builder README (secrets model). + signing-key: ${{ secrets.REGISTRY_SIGNING_KEY }} bake: 'true' atom-repo: ${{ github.repository }} list-name: 'Reference Python Plugins' From cca009fbbb9bf8fe640f8e02ebac6a07bc493dda Mon Sep 17 00:00:00 2001 From: Lucio Date: Tue, 21 Jul 2026 17:43:46 +0200 Subject: [PATCH 3/4] signing plugins --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c17c85f..30cd381 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -36,7 +36,7 @@ jobs: bake: 'true' atom-repo: ${{ github.repository }} list-name: 'Reference Python Plugins' - list-publisher: 'PLACEHOLDER' + list-publisher: '679939555819fb5f6423dc68c4388e76bfa9b4e0' list-ref-name: 'Reference Python Plugins' main-index-repo: Bespok3d/main-index # Per-repo Actions secret today (GitHub Free cannot org-secret private repos); becomes ONE org From e1b4af08f36a8c3165c2bed0335230e9c383509e Mon Sep 17 00:00:00 2001 From: Lucio Date: Tue, 21 Jul 2026 20:07:33 +0200 Subject: [PATCH 4/4] pin the builder at the signing-capable main --- .github/workflows/pr-build.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml index 81461a6..d8a5602 100644 --- a/.github/workflows/pr-build.yml +++ b/.github/workflows/pr-build.yml @@ -35,7 +35,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: Bespok3d/b3-builder@66509afcc88b13f911e252ebede80ac04c13f6bd # main @ 2026-07-19 + - uses: Bespok3d/b3-builder@76d815a56dc5708b3d0c3a587fc2b027deca4640 # main @ 2026-07-21 with: unit: repo bake: 'true' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 30cd381..d51b95a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -27,7 +27,7 @@ jobs: with: fetch-depth: 0 # full history so the index.json push can rebase on a concurrent update - - uses: Bespok3d/b3-builder@66509afcc88b13f911e252ebede80ac04c13f6bd # main @ 2026-07-19 + - uses: Bespok3d/b3-builder@76d815a56dc5708b3d0c3a587fc2b027deca4640 # main @ 2026-07-21 with: unit: repo # Per-repo Actions secret today (GitHub Free cannot org-secret private repos); becomes ONE org