From 1b95c11f8ece5f920fb631d8165571277edf3966 Mon Sep 17 00:00:00 2001 From: J3vb <192430104+J3vb@users.noreply.github.com> Date: Mon, 20 Jul 2026 15:26:22 +0200 Subject: [PATCH] ci: stop injecting VITE_KLIPY_API_KEY into release builds The GIF key now lives in server config, so no build job needs it. Leaving the secret wired into the build env is the exact mechanism that leaked the original key: any future re-add of import.meta.env.VITE_KLIPY_API_KEY would silently inline it into the bundle again with the secret already present. Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4025edfa..d9803dc4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -37,7 +37,6 @@ jobs: env: TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} - VITE_KLIPY_API_KEY: ${{ secrets.VITE_KLIPY_API_KEY }} run: npm run tauri build - name: Stage Windows release assets @@ -103,7 +102,6 @@ jobs: env: TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} - VITE_KLIPY_API_KEY: ${{ secrets.VITE_KLIPY_API_KEY }} run: npm run tauri build -- --bundles appimage,deb - name: Stage Linux release assets @@ -232,7 +230,6 @@ jobs: env: TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} - VITE_KLIPY_API_KEY: ${{ secrets.VITE_KLIPY_API_KEY }} run: npm run tauri build -- --bundles appimage,deb - name: Stage Linux ARM64 release assets