Forward a Second Site's Token Pair to the Deploy-Site Verify Hook

[ptr727]

Summary

A gate's access token opens only the resource it was issued for. A bundle that serves a second site on its own hostname, behind its own gate, cannot verify that site with the first site's pair. Every such request is redirected to the login page.

• deploy-site-task.yml declares an optional SITE_EXTRA_AUTH_TOKEN_ID/SITE_EXTRA_AUTH_TOKEN secret pair.
• The assert step checks the new pair both-or-neither, like the existing pair. It also refuses a mapped pair when the SITE_EXTRA_BASE_URL environment variable is empty, since then there is no site to check.
• The new pair and SITE_EXTRA_BASE_URL are forwarded as env: to the verify invocation only. The build, prune, upload and flip steps never see them.
• WORKFLOW.md and docs/reusable-workflows.md state the new handoff, and the tracker records it.

This is the first of the candidate shapes on #2031, as the maintainer decided there. Each caller maps its own secret names onto the new pair, and its verify hook reads them. Blog's side is Blog#272.

The added workflow comments follow the existing pattern for the first pair, hence the comments label.

Verification

actionlint, markdownlint, cspell, the prose gate over the merge-base diff, spec/validate.py, and the unittest suite all pass. A local strict review ran once, and its only finding was the comments label, which this PR carries.

Closes on promotion: #2031

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: ptr727/ProjectTemplate/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: f2148d62-6271-40ad-b1f3-e66ab4e5ffba

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (develop@6adf0bf). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #2173   +/-   ##
==========================================
  Coverage           ?   56.47%           
==========================================
  Files              ?       16           
  Lines              ?     7455           
  Branches           ?        0           
==========================================
  Hits               ?     4210           
  Misses             ?     3245           
  Partials           ?        0           

Flag	Coverage Δ
python-3.13	56.47% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The change forwards deployment authentication secrets across a cross-repository reusable-workflow boundary, a security-sensitive CI/CD surface that warrants final human confirmation even though the additive logic mirrors the existing verified pattern and has no defects.

Review effort: Balanced
Findings: None

What changed in this PR

This PR extends the hub-hosted deploy-site-task.yml so a deploy bundle that serves a second token-gated site (on its own hostname behind its own proxy resource) can forward that site's credentials to the verify hook. A Pangolin resource access token is bound to one resource, so the first site's pair cannot authenticate the second; without this, every second-site verification request is redirected to the login page. The change realizes the first candidate shape decided in issue #2031: a generic optional extra pair plus a base-URL variable, forwarded as env: on the verify invocation only, with each caller mapping its own secret names onto these generic names.

Changes:

• Declare optional SITE_EXTRA_AUTH_TOKEN_ID/SITE_EXTRA_AUTH_TOKEN secrets and assert them both-or-neither, additionally requiring a non-empty SITE_EXTRA_BASE_URL when the pair is mapped.
• Forward SITE_EXTRA_BASE_URL and the extra pair as env: on the verify hook invocation only, leaving build/prune/upload/flip untouched.
• Document the new handoff in WORKFLOW.md, docs/reusable-workflows.md, and its adoption tracker.

File	Description
.github/​workflows/​deploy-site-task.yml	Adds the optional second-site secret pair, its both-or-neither + base-URL assert, and env forwarding on the verify step only.
WORKFLOW.md	Updates the hugo deploy contract prose to describe the extra pair and its SITE_EXTRA_BASE_URL requirement.
docs/​reusable-workflows.md	Documents the second-site handoff in the Deploy-site section and adoption tracker, adding the issue-2031 reference link.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ptr727]

Merging without a CodeRabbit round, by the maintainer's decision on 2026-09-30. CodeRabbit's hourly review quota was already spent on #2169 and is reserved for #2172. What read this change: Copilot at head 913b8bf1 (full file-table coverage, no findings) and one local strict review pass.