ci: upload QA builds for installer #10479
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-project-automation
bot
moved this to 🟡 Code Review: Ready for Review
in Quality Assurance
FoxtrotSierra6829
added
Do Not Merge
Not Ready For Review
FoxtrotSierra6829
force-pushed
the
quality-assurance-installer
branch
8 times, most recently
from
7cc8626 to
100fa04
Compare
FoxtrotSierra6829
removed
the
Not Ready For Review
FoxtrotSierra6829
force-pushed
the
quality-assurance-installer
branch
from
d62d09e to
2ab8f2e
Compare
FoxtrotSierra6829
force-pushed
the
quality-assurance-installer
branch
from
e5b6353 to
a987061
Compare
ci: direct cdn upload (flybywiresim#10478) ci: direct cdn upload (flybywiresim#10478) chore: remove stale Bunny CDN script ci: fix order docs: remove cdn.sh
tracernz
reviewed
Jan 27, 2026
Comment on lines
-61
to
+69
| echo CLIENT_ID=\"${{ secrets.NAVIGRAPH_CLIENT_ID_A380X }}\" >> fbw-a380x/.env | ||
| echo CLIENT_SECRET=\"${{ secrets.NAVIGRAPH_CLIENT_SECRET_A380X }}\" >> fbw-a380x/.env | ||
| echo CHARTFOX_SECRET=\"${{ secrets.CHARTFOX_SECRET }}\" >> fbw-a380x/.env | ||
| echo SENTRY_DSN=\"${{ secrets.SENTRY_DSN }}\" >> fbw-a380x/.env | ||
| echo CLIENT_ID=\"\" >> fbw-a380x/.env | ||
| echo CLIENT_SECRET=\"\" >> fbw-a380x/.env | ||
| echo CHARTFOX_SECRET=\"\" >> fbw-a380x/.env | ||
| echo SENTRY_DSN=\"\" >> fbw-a380x/.env | ||
| echo AIRCRAFT_PROJECT_PREFIX=${{ env.AIRCRAFT_PROJECT_PREFIX }} >> fbw-a380x/.env | ||
| echo AIRCRAFT_VARIANT=${{ env.AIRCRAFT_VARIANT }} >> fbw-a380x/.env | ||
| echo BUILD_DIR_NAME=${{ env.BUILD_DIR_NAME }} >> .env | ||
| echo LOCALAZY_READ_KEY=${{ secrets.LOCALAZY_READ_KEY }} >> .env | ||
| echo LOCALAZY_READ_KEY=\"\" >> .env |
Member
There was a problem hiding this comment.
Why do we want to remove these ones? That will prevent us from testing the Navigraph integration?
Member
Author
There was a problem hiding this comment.
Additional context
Secrets are now only accessed when handling code of the trusted targeted branch. Previously, secrets could be accessed on PRs from upstream branches but were inaccessible from PRs from forks.
This is running untrusted code which can potentially leak secrets. Previously the secrets just weren't available on fork PRs but now since the context is the target branch but except for the workflow file we are running PR code until later, these secrets would be available to be dumped.
FozzieHi
reviewed
Jan 28, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Requires (incorporates) #10478
Summary of Changes
Screenshots (if necessary)
References
FoxtrotSierra6829/fbw-aircraft-test#1
FoxtrotSierra6829/fbw-aircraft-test#2
FoxtrotSierra6829/fbw-aircraft-test#3
FoxtrotSierra6829/fbw-aircraft-test#4
Additional context
flybywiresim/installer#537
Secrets are now only accessed when handling code of the trusted targeted branch. Previously, secrets could be accessed on PRs from upstream branches but were inaccessible from PRs from forks.
Discord username (if different from GitHub):
foxtrotsierra
Testing instructions
https://flybywirecdn.com/installer/qa-config/pull-requests.jsonNOTE: Clicking the PR title in the description will lead to a different PR, this is not an issue but working as intended. The test PRs are from another repo.
How to download the PR for QA
Every new commit to this PR will cause new A32NX and A380X artifacts to be created, built, and uploaded.