From c6b467b60ad80867f3de0694ea2cbc6c08acc5c0 Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Wed, 1 Jul 2026 09:45:30 +0800 Subject: [PATCH] fix(ci): update VAULT_ROLE to github-actions-site-migration-toolkit per user request --- .github/workflows/deploy-env-migration.yaml | 2 +- README.md | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/deploy-env-migration.yaml b/.github/workflows/deploy-env-migration.yaml index 3381813..e99f8b8 100644 --- a/.github/workflows/deploy-env-migration.yaml +++ b/.github/workflows/deploy-env-migration.yaml @@ -63,7 +63,7 @@ concurrency: env: VAULT_ADDR: https://vault.svc.plus - VAULT_ROLE: github-actions-site-recovery + VAULT_ROLE: github-actions-site-migration-toolkit VAULT_KV: kv/data/CICD VAULT_KV_OPENCLAW: kv/data/openclaw VPS_ROOT: infra/iac_modules/terraform-hcl-standard/vultr-vps diff --git a/README.md b/README.md index 4c41240..4742084 100644 --- a/README.md +++ b/README.md @@ -53,8 +53,8 @@ Only reserve roadmap placeholders for: ### ⚠️ CI/CD Prerequisites (Important Notice) If you are running the GitHub Actions workflow (`deploy-env-migration.yaml`), please ensure that your Vault environment is correctly configured: -- **Vault Role**: The current configured role is `github-actions-site-recovery` (kept for backward compatibility with the old repository name). Ensure this role exists in your Vault instance. -- **Role Binding**: If the role is bound to the repository name, make sure the `bound_claims` match or are updated to reflect the new repository name if you ever recreate the role. +- **Vault Role**: The required role name is `github-actions-site-migration-toolkit`. +- **Role Binding**: Ensure the JWT `bound_claims` match the new repository name (`repo:ai-workspace-infra/site-migration-toolkit:ref:refs/heads/main` or similar). --- @@ -111,5 +111,5 @@ If you are running the GitHub Actions workflow (`deploy-env-migration.yaml`), pl ### ⚠️ CI/CD 前置条件 (重要提示) 如果您正在运行 GitHub Actions 流水线 (`deploy-env-migration.yaml`)，请确保您的 Vault 环境已正确配置： -- **Vault 角色 (Role)**: 当前配置的角色名为 `github-actions-site-recovery`（为兼容旧代码库名而保留）。请确保您的 Vault 实例中存在该角色。 -- **角色绑定 (Role Binding)**: 如果该角色是基于代码库名称绑定的，请确保其 `bound_claims` 匹配，或者在重建角色时更新为新的代码库名称。 +- **Vault 角色 (Role)**: 所需的角色名为 `github-actions-site-migration-toolkit`。 +- **角色绑定 (Role Binding)**: 请确保 JWT 的 `bound_claims` 匹配新的代码库名称（例如 `repo:ai-workspace-infra/site-migration-toolkit:ref:refs/heads/main`）。