From 3c40a24a37a94bce9d770b24efe1d3b8b8c760a2 Mon Sep 17 00:00:00 2001 From: DIodide Date: Fri, 3 Jul 2026 23:11:52 -0400 Subject: [PATCH] ci(deploy): install SKILLS_GITHUB_TOKEN as GITHUB_TOKEN in the backend .env MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gateway's SKILL.md backfill (skill_content.py) calls the GitHub API unauthenticated from one EC2 IP — 60 req/hr shared across every user. Write the SKILLS_GITHUB_TOKEN secret into the host .env on deploy (replace-on- deploy, so rotating the secret rotates the host; skipped when unset). The Convex-side skill imports get the same token via the Convex env directly. (cherry picked from commit b6b74a5ae0dab77e37d7af43e7d78a90eec32994) --- .github/workflows/backend-cd.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/backend-cd.yml b/.github/workflows/backend-cd.yml index 5b43db3..30d6ca8 100644 --- a/.github/workflows/backend-cd.yml +++ b/.github/workflows/backend-cd.yml @@ -80,6 +80,13 @@ jobs: # REDIS_URL just disables live-following fan-out. grep -q '^REDIS_URL=' .env 2>/dev/null || \ echo 'REDIS_URL=redis://127.0.0.1:6379/${{ steps.env.outputs.redis_db }}' >> .env + # GitHub token for the gateway's SKILL.md backfill (raises the API + # rate limit from 60/hr/IP to 5000/hr). Replace-on-deploy so + # rotating the SKILLS_GITHUB_TOKEN secret rotates the host. + if [ -n '${{ secrets.SKILLS_GITHUB_TOKEN }}' ]; then + sed -i '/^GITHUB_TOKEN=/d' .env 2>/dev/null || true + echo 'GITHUB_TOKEN=${{ secrets.SKILLS_GITHUB_TOKEN }}' >> .env + fi python3.11 -m venv .venv 2>/dev/null || true .venv/bin/pip install -q -r requirements.txt sudo systemctl restart ${{ steps.env.outputs.service }}