Catcrafts/catcrafts.net
Watch
2
0
Fork
You've already forked catcrafts.net
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Replaced mollie
All checks were successful
Deploy / build-deploy (push) Successful in 3m47s
Details

Browse source
This commit is contained in:
Jorijn van der Graaf 2026-08-20 20:15:47 +02:00
commit df91762271
29 changed files with 3079 additions and 838 deletions
Download patch file Download diff file Expand all files Collapse all files

48
.forgejo/workflows/deploy.yaml
View file

@ -16,32 +16,28 @@ jobs:
runs-on: arch-latest
steps:
- name: Check live payment test credentials
# The live-provider suites (ShouldCreateMollieTestPayments,
# ShouldSettleEurcOnTestnet) are mandatory deploy gates, so a missing
# or malformed secret fails HERE, before any build time is spent —
# never as a silent skip. Secrets live in Forgejo: repo Settings ->
# Actions -> Secrets. See deploy/README.md "Live payment suites in CI"
# for what each one is and how to fund the testnet wallet.
# ShouldSettleEurcOnTestnet is a mandatory deploy gate, so a missing
# secret fails HERE, before any build time is spent — never as a silent
# skip. The secret lives in Forgejo: repo Settings -> Actions ->
# Secrets. See deploy/README.md "Live payment suites in CI" for what it
# is and how to keep the testnet wallet funded.
#
# There is ONE live suite now, not two. The bank half used to be a
# hosted provider with a test-mode API, and that gate died with the
# account on 2026-08-20. Its replacement is a transfer to our own
# account, which has no counterpart to call and therefore no credential
# to check: ShouldSettleBankTransfers drives the real rail with no
# network at all and runs unconditionally with the other black-box
# suites. Losing a live gate here is a fact about the rail, not a
# weakening of the standard.
env:
MOLLIE_TEST_API_KEY: ${{ secrets.MOLLIE_TEST_API_KEY }}
EURC_E2E_PRIVATE_KEY: ${{ secrets.EURC_E2E_PRIVATE_KEY }}
run: |
set -eu
ok=1
if [ -z "${MOLLIE_TEST_API_KEY:-}" ]; then
echo "ERROR: MOLLIE_TEST_API_KEY secret is not set (Mollie dashboard -> Developers -> API keys, the test_ one)." >&2
ok=0
else
case "$MOLLIE_TEST_API_KEY" in
test_*) ;;
*) echo "ERROR: MOLLIE_TEST_API_KEY is not a test_ key — the suite refuses to create payments on a live key." >&2; ok=0 ;;
esac
fi
if [ -z "${EURC_E2E_PRIVATE_KEY:-}" ]; then
echo "ERROR: EURC_E2E_PRIVATE_KEY secret is not set (a Base Sepolia key holding testnet EURC + gas)." >&2
ok=0
echo "ERROR: EURC_E2E_PRIVATE_KEY secret is not set (an Ethereum Sepolia key holding testnet EURC + gas)." >&2
exit 1
fi
[ "$ok" = 1 ] || exit 1
echo "Live payment test credentials are present."
- name: Install build dependencies
@ -186,18 +182,18 @@ jobs:
# E2E_MEDIA_DIR points ShouldServePostPages at the mirror mount, where
# the media files actually are.
#
# The two payment secrets feed the live-provider suites, which run as
# part of this same gate: a deploy that cannot create a Mollie test
# payment or settle a testnet EURC transfer does not ship. If the
# EURC suite fails at `cast send`, the testnet wallet is empty — see
# deploy/README.md "Live payment suites in CI" for the faucets.
# EURC_E2E_PRIVATE_KEY feeds the live crypto suite, which runs as part
# of this same gate: a deploy that cannot settle a testnet EURC
# transfer does not ship. If it fails at `cast send`, the testnet
# wallet is empty — see deploy/README.md "Live payment suites in CI"
# for the faucets. The bank rail's own suite needs no secret; it drives
# the real rail with a credits file instead of a provider.
#
# Same refuse-to-guess rule as the wasm bundle below: a variant
# directory embeds a config hash, so more than one match means the tree
# is ambiguous and picking the first would deploy an arbitrary build.
env:
E2E_MEDIA_DIR: ${{ steps.media.outputs.dir }}
MOLLIE_TEST_API_KEY: ${{ secrets.MOLLIE_TEST_API_KEY }}
EURC_E2E_PRIVATE_KEY: ${{ secrets.EURC_E2E_PRIVATE_KEY }}
run: |
set -eux