Skip to content

Skip Hex API key validation in CI workflow #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lupodevelop merged 1 commit into from
Nov 16, 2025
Merged

Skip Hex API key validation in CI workflow #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 6 additions & 11 deletions .github/workflows/publish-gleam.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ jobs:
exit 1
fi

- name: Verify HEX API key via HTTP
- name: Trust HEX API key presence (skip /api/me check)
env:
HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
run: |
Expand All @@ -125,16 +125,11 @@ jobs:
echo "HEX_API_KEY secret is not set; aborting"
exit 1
fi
# ask for JSON explicitly
RES=$(curl -s -w "%{http_code}" -H "Authorization: Bearer ${HEX_API_KEY}" -H "Accept: application/vnd.hex+json; version=1.0" https://hex.pm/api/me)
HTTP=${RES: -3}
BODY=${RES:: -3}
echo "HTTP status: ${HTTP}"
if [ "${HTTP}" != "200" ]; then
echo "HEX API key invalid or API returned ${HTTP}. Response body preview:"
echo "${BODY}" | sed -n '1,40p'
exit 1
fi
# Do not call the Hex API here (some environments return unexpected 404s).
# Treat the presence of a non-empty secret as 'valid' for CI publishing.
# Do not print the key or any masked preview in logs.
# Only confirm that the secret is present to avoid accidental leaks.
echo "HEX_API_KEY is set"

- name: Check if version already published on Hex
run: |
Expand Down