Skip to content

description: Every variable and secret that the workflows of Repo Blueprint read or that its settings as code set: what it does, who sets it and which workflows read it.

Variables and secrets

The workflows read the variables of the repository as vars.NAME and its secrets as secrets.NAME. The settings as code set most of the variables from the answers of Copier, and the checklist of python3 .github/blueprint.py checklist names each secret that is missing, with the command that sets it; the value goes into the prompt of the GitHub CLI and nowhere else. A variable that isn't set reads as empty, and so does a secret, which the workflows check before they use it.

Variables

  • BETA_CHANNEL: true makes every change for users that reaches main, a feat, fix or perf, a beta of the next release, such as 1.3.0-beta.2, which the release publishes as a prerelease for the testers who take prereleases.
  • BLUEPRINT_AUTOMERGE: off makes every update of the blueprint wait for the maintainer, where its pull request would merge itself once every check passes; an update with conflicts waits either way.
  • ISSUE_ASSISTANT_AI: off makes the issue assistant label the issues and answer the commands of their comments without an AI engine, which then needs no secret; on lets the engine analyze each new issue as well.
  • MUTATION_PARTS: The number of parts in which the mutation tests run, one job each, in place of the estimate from the number of mutants: more parts for a project whose parts run out of the six hours of a job.
  • PUBLISH_TO: Where the release delivers the package: pypi, npm, ghcr, hacs, nextcloud-appstore, github-action or none, by the kind of project.
  • RELEASE_APP: The name of the release app, as its address says: github.com/apps/NAME.
  • RELEASE_AUTOMATION_APP_ID: The App ID of the release app, the number on its settings page.
  • RELEASE_AUTOMATION_CLIENT_ID: The Client ID of the release app, with which each bot asks for a token of the app, together with the private key RELEASE_AUTOMATION_PRIVATE_KEY.
  • UPSTREAM_AUTOMERGE: off makes the pull request of the upstream bot of a Nextcloud app, which raises max-version to a new major version of Nextcloud, wait for the maintainer, where it would merge itself once every check passes.

BETA_CHANNEL

true makes every change for users that reaches main, a feat, fix or perf, a beta of the next release, such as 1.3.0-beta.2, which the release publishes as a prerelease for the testers who take prereleases. Without it, or with any other value, no betas are published.

  • Set by: you, where you want it: in [variables] of .github/repository.project.toml, which the settings bot applies, or under Settings → Secrets and variables → Actions → Variables
  • Read by: release.yml (Release, every repository)

What the workflows say of it:

  • release.yml: Where the repository variable BETA_CHANNEL is true, every change for users that reaches main, a feat, fix or perf, becomes a beta of the next release, such as 1.3.0-beta.2, for the testers who take prereleases.

BLUEPRINT_AUTOMERGE

off makes every update of the blueprint wait for the maintainer, where its pull request would merge itself once every check passes; an update with conflicts waits either way. Set it to on, or delete it with gh variable delete BLUEPRINT_AUTOMERGE, and the updates merge themselves again: the settings bot never deletes a variable, so removing its line from .github/repository.project.toml leaves off in place.

  • Set by: you, where you want it: in [variables] of .github/repository.project.toml, which the settings bot applies, or under Settings → Secrets and variables → Actions → Variables
  • Read by: blueprint-update.yml (Blueprint update, every repository)

What the workflows say of it:

  • blueprint-update.yml: The repository variable BLUEPRINT_AUTOMERGE set to off makes every update wait.

ISSUE_ASSISTANT_AI

off makes the issue assistant label the issues and answer the commands of their comments without an AI engine, which then needs no secret; on lets the engine analyze each new issue as well.

  • Set by: the settings as code: .github/repository.toml sets it, from issue_assistant_ai, and the settings bot applies it; .github/repository.project.toml can set another value
  • Read by: issue-assistant.yml (Issue assistant, every repository)

What the workflows say of it:

  • issue-assistant.yml: Without the engine's secret in the environment issue-assistant, or with the repository variable ISSUE_ASSISTANT_AI set to "off", only labels and the lifecycle work.

MUTATION_PARTS

The number of parts in which the mutation tests run, one job each, in place of the estimate from the number of mutants: more parts for a project whose parts run out of the six hours of a job.

  • Set by: you, where you want it: in [variables] of .github/repository.project.toml, which the settings bot applies, or under Settings → Secrets and variables → Actions → Variables
  • Read by: mutation.yml (Mutation, where stack in ['python', 'home-assistant', 'php'])

PUBLISH_TO

Where the release delivers the package: pypi, npm, ghcr, hacs, nextcloud-appstore, github-action or none, by the kind of project. The build, the release and the check of the latest release follow it.

  • Set by: the settings as code: .github/repository.toml sets it, from publish_to, and the settings bot applies it; .github/repository.project.toml can set another value
  • Read by: build-release.yml (Build the release, every repository); release.yml (Release, every repository); verify-release.yml (Release verification, every repository)

What the workflows say of it:

  • release.yml: The jobs below attach the package, its SBOMs (SPDX and CycloneDX), the licenses of its third-party components, the advisories that don't affect it (OpenVEX) and its signed provenance, write the notes, make the release public, announce it in the discussions, and then deliver it where the repository variable PUBLISH_TO says: pypi, npm, ghcr, hacs, nextcloud-appstore, github-action or none.
  • verify-release.yml: It checks a release the way its users can: every asset carries the signed provenance of this repository's release workflow, both in GitHub and in the attached bundle; the SBOMs are attached and describe what the release ships, by its name and version; the release is immutable and its commit signed; and where the repository variable PUBLISH_TO delivers it, the same release is there.

RELEASE_APP

The name of the release app, as its address says: github.com/apps/NAME. No workflow reads it; the checklist of blueprint.py links the installation of the app with it.

  • Set by: the settings as code: .github/repository.toml sets it, from release_app, and the settings bot applies it; .github/repository.project.toml can set another value
  • Read by: no workflow

RELEASE_AUTOMATION_APP_ID

The App ID of the release app, the number on its settings page. No workflow reads it; the settings as code let only this app create release tags, in the ruleset Release tag creation.

  • Set by: the settings as code: .github/repository.toml sets it, from release_app_id, and the settings bot applies it; .github/repository.project.toml can set another value
  • Read by: no workflow

RELEASE_AUTOMATION_CLIENT_ID

The Client ID of the release app, with which each bot asks for a token of the app, together with the private key RELEASE_AUTOMATION_PRIVATE_KEY. Without it, the bots say in their summary what is missing, and the release pull request starts no checks.

UPSTREAM_AUTOMERGE

off makes the pull request of the upstream bot of a Nextcloud app, which raises max-version to a new major version of Nextcloud, wait for the maintainer, where it would merge itself once every check passes.

  • Set by: you, where you want it: in [variables] of .github/repository.project.toml, which the settings bot applies, or under Settings → Secrets and variables → Actions → Variables
  • Read by: upstream.yml (Upstream, where project_type == 'nextcloud-app')

What the workflows say of it:

  • upstream.yml: It merges itself once they pass, unless the repository variable UPSTREAM_AUTOMERGE is off.

Secrets

  • ANTHROPIC_API_KEY: An API key of Anthropic, which the issue assistant takes in place of CLAUDE_CODE_OAUTH_TOKEN to analyze each new issue with Claude, at the prices of Anthropic's API.
  • APPSTORE_TOKEN: The API token of the account of the Nextcloud App Store, with which the release submits the signed package and the workflow Register app registers the id of the app.
  • APP_PRIVATE_KEY: The private key of the certificate of a Nextcloud app, with which the release signs the package for the App Store and the workflow Register app proves the id of the app.
  • CLAUDE_CODE_OAUTH_TOKEN: The token of a Claude subscription, which claude setup-token of Claude Code creates, with which the issue assistant analyzes each new issue with Claude.
  • GITHUB_TOKEN: The token that GitHub gives every run of a workflow, for its repository alone and with the permissions that its permissions: grant.
  • RELEASE_AUTOMATION_PRIVATE_KEY: The private key of the release app, the file that its settings page generates.

ANTHROPIC_API_KEY

An API key of Anthropic, which the issue assistant takes in place of CLAUDE_CODE_OAUTH_TOKEN to analyze each new issue with Claude, at the prices of Anthropic's API. Set one of the two; without either, the assistant works without AI, as with ISSUE_ASSISTANT_AI set to off.

  • Set by: you, as a secret of the environment issue-assistant, which only main may use: gh secret set ANTHROPIC_API_KEY --env issue-assistant
  • Read by: issue-assistant.yml (Issue assistant, every repository)

APPSTORE_TOKEN

The API token of the account of the Nextcloud App Store, with which the release submits the signed package and the workflow Register app registers the id of the app. Only a Nextcloud app needs it.

  • Set by: you, as a secret of the environment release, which only main may use: gh secret set APPSTORE_TOKEN --env release, as the checklist shows
  • Read by: register-app.yml (Register the app, where project_type == 'nextcloud-app'); release.yml (Release, every repository)

APP_PRIVATE_KEY

The private key of the certificate of a Nextcloud app, with which the release signs the package for the App Store and the workflow Register app proves the id of the app. Only a Nextcloud app needs it.

  • Set by: you, as a secret of the environment release, which only main may use: gh secret set APP_PRIVATE_KEY --env release, as the checklist shows
  • Read by: build-release.yml (Build the release, every repository); register-app.yml (Register the app, where project_type == 'nextcloud-app')

CLAUDE_CODE_OAUTH_TOKEN

The token of a Claude subscription, which claude setup-token of Claude Code creates, with which the issue assistant analyzes each new issue with Claude. The checklist asks for it while the answer issue_assistant_ai is on; ANTHROPIC_API_KEY works in its place.

  • Set by: you, as a secret of the environment issue-assistant, which only main may use: gh secret set CLAUDE_CODE_OAUTH_TOKEN --env issue-assistant, as the checklist shows
  • Read by: issue-assistant.yml (Issue assistant, every repository)

GITHUB_TOKEN

The token that GitHub gives every run of a workflow, for its repository alone and with the permissions that its permissions: grant. What a workflow does with it starts no other workflow, which is why the bots that open, update or merge pull requests act as the release app.

What the workflows say of it:

  • release.yml: A pull request of the release app starts the checks; one of the job's GITHUB_TOKEN would start none.

RELEASE_AUTOMATION_PRIVATE_KEY

The private key of the release app, the file that its settings page generates. With it and RELEASE_AUTOMATION_CLIENT_ID, the bots act as the app: they open and merge the release and update pull requests, so that their checks run, create the release tags and apply the settings. The file goes in with < key.pem after the command below.