Rename PANGOLIN_ACCESS_TOKEN_* to SITE_AUTH_TOKEN_*

[ptr727]

Follow-up to #103. The stored GitHub secret on staging was renamed live (same values, no secret read here) to match the hub task's own generic SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN interface, the same shape as the earlier HUGO_BASEURL -> SITE_BASE_URL rename.

.github/actions/deploy/action.yml already bridges the hub's SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN into PANGOLIN_ACCESS_TOKEN_ID/PANGOLIN_ACCESS_TOKEN for check-live-urls.sh, so the hook itself needs no change. That script keeps its own Pangolin-specific naming, and the local secrets/*.env convention plus example.env are unaffected.

Verified

checks/check-env-docs.py (36 values, all described), scripts/docker_lint.py --linter actionlint --linter editorconfig-checker, scripts/prose_lint.py --diff origin/main, and scripts/repo_gate.py --check sha-pin --exclude 'themes/*/**' all pass clean.

Summary by CodeRabbit

• Chores
  • Updated deployment configuration to use the new site authentication secret names.
  • Updated environment and staging documentation to reflect renamed authentication secrets.
  • Renamed the site base URL setting from HUGO_BASEURL to SITE_BASE_URL.
  • Preserved compatibility with existing deployment checks through configuration bridging.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d34a9a80-af23-471c-a814-4ab65e3bbc9a

📥 Commits

Reviewing files that changed from the base of the PR and between 4964dda and adb7214.

📒 Files selected for processing (1)

• spec/secrets.json

Included review availability: Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The deploy workflow now forwards SITE_AUTH_TOKEN_ID and SITE_AUTH_TOKEN. Environment references use these names. The secret specification replaces HUGO_BASEURL with SITE_BASE_URL.

Changes

Site authentication secret rename

Layer / File(s)	Summary
Secret forwarding and documentation .github/workflows/deploy-site.yml, ENVIRONMENT.md, TODO.md, spec/secrets.json	The deploy workflow uses the renamed repository secrets and maps them to the existing Pangolin variable names. Environment references and the secret specification use the updated names. The shared site URL variable is now SITE_BASE_URL.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to adb72

This change standardizes secret names and documentation without changing secret values or runtime behavior; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: renaming the PANGOLIN_ACCESS_TOKEN_* secrets to SITE_AUTH_TOKEN_* names.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rename-site-auth-token

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Rename deploy auth secrets to SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN

⚙️ Configuration changes 📝 Documentation 🕐 20-40 Minutes

AI Description

• Switch deploy workflow to read SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN secrets directly.
• Clarify production behavior when auth-token secrets are intentionally unset.
• Update environment and TODO docs to reflect the renamed staging-only secrets.

Diagram

graph TD
  SE[("GitHub env secrets")] --> WF["deploy-site.yml"] --> HUB["Hub deploy task"] --> ACT["deploy action.yml"] --> CHK["check-live-urls.sh"]
  DOC["Docs (ENVIRONMENT/TODO)"] -.-> WF

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Temporary dual-name fallback in workflow

• ➕ Backward-compatible for forks or environments still using PANGOLIN_ACCESS_TOKEN_*
• ➕ Reduces risk of failed deploys during transition
• ➖ Prolongs deprecation and keeps two names in circulation
• ➖ Slightly more complex workflow expressions and docs

2. Keep old secret names and only map in hub task

• ➕ Avoids renaming secrets in this repo’s environment configuration
• ➖ Conflicts with the hub task’s generic interface and makes other sites less consistent
• ➖ More cognitive overhead when operating multiple repos/environments

Recommendation: Current approach is best if the secret rename has already been performed and you want alignment with the hub task’s generic interface. Consider the dual-name fallback only if you expect external forks/automation to still depend on PANGOLIN_ACCESS_TOKEN_* for a transition period.

Files changed (3) +7 / -8

Documentation (2) +3 / -3

ENVIRONMENT.mdDocument SITE_AUTH_TOKEN_* as the staging auth secrets +2/-2

Document SITE_AUTH_TOKEN_* as the staging auth secrets

• Renames the documented staging-only auth secrets from PANGOLIN_ACCESS_TOKEN_* to SITE_AUTH_TOKEN_*. Notes that the deploy action bridges these values to Pangolin-named variables for the URL-check script.

ENVIRONMENT.md

TODO.mdUpdate environment secret checklist to SITE_AUTH_TOKEN_* +1/-1

Update environment secret checklist to SITE_AUTH_TOKEN_*

• Replaces the staging-only secret pair name in the environment checklist to match the new SITE_AUTH_TOKEN_* naming.

TODO.md

Other (1) +4 / -5

deploy-site.ymlRead SITE_AUTH_TOKEN_* secrets directly for cross-repo deploy +4/-5

Read SITE_AUTH_TOKEN_* secrets directly for cross-repo deploy

• Updates the workflow secrets mapping to pass SITE_AUTH_TOKEN_ID and SITE_AUTH_TOKEN instead of the Pangolin-specific secret names. Simplifies comments while preserving the documented behavior where production passes empty auth-token values to indicate a public site.

.github/workflows/deploy-site.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

1. Secrets manifest not updated ✓ Resolved 🐞 Bug ≡ Correctness

Description

After renaming the deploy workflow to read SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN, spec/secrets.json
still declares staging’s environment-scoped secrets as
PANGOLIN_ACCESS_TOKEN_ID/PANGOLIN_ACCESS_TOKEN. This makes the documented/audited environment-secret
ground truth wrong and can cause staging deploy verification to run without the auth token (or
audits to report false drift).

Code

.github/workflows/deploy-site.yml[R69-70]

+      SITE_AUTH_TOKEN_ID: ${{ secrets.SITE_AUTH_TOKEN_ID }}
+      SITE_AUTH_TOKEN: ${{ secrets.SITE_AUTH_TOKEN }}

Relevance

●●● Strong

Team accepts keeping authoritative docs/manifests synced with implementation changes, per similar
past fixes.

PR-#56
PR-#77

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR changes the deploy workflow to read SITE_AUTH_TOKEN_* secrets, but the environment secrets
manifest still expects the old PANGOLIN_* names on staging. The deploy hook then maps
SITE_AUTH_TOKEN_* into PANGOLIN_* only at runtime for the URL check, confirming SITE_AUTH_TOKEN_* is
now the expected environment-facing interface; meanwhile AUDIT.md explicitly treats
spec/secrets.json as the ground truth for auditing environment-scoped secret names.

.github/workflows/deploy-site.yml[65-70]
spec/secrets.json[20-43]
.github/actions/deploy/action.yml[90-102]
AUDIT.md[51-76]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The deploy workflow now passes `SITE_AUTH_TOKEN_ID`/`SITE_AUTH_TOKEN` into the cross-repo `deploy-site-task.yml`, but `spec/secrets.json` still declares the staging environment secrets as `PANGOLIN_ACCESS_TOKEN_ID`/`PANGOLIN_ACCESS_TOKEN`. This breaks the repo’s documented/audited ground truth for environment-scoped secrets.

## Issue Context
- The workflow change means the deploy pipeline will look for `SITE_AUTH_TOKEN_*` in the GitHub Environment secrets store.
- The verification hook bridges `SITE_AUTH_TOKEN_*` into `PANGOLIN_*` only at runtime for `checks/check-live-urls.sh`.
- The environment-scope secrets are manually audited against `spec/secrets.json` per `AUDIT.md`.

## Fix Focus Areas
- spec/secrets.json[20-43]
- AUDIT.md[51-76]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. PR title exceeds 72 chars 📘 Rule violation ⚙ Maintainability

Description

The PR title is 91 characters long, exceeding the 72-character limit. Overlong titles reduce
readability in review tooling and release notes.

Code

.github/workflows/deploy-site.yml[R69-70]

+      SITE_AUTH_TOKEN_ID: ${{ secrets.SITE_AUTH_TOKEN_ID }}
+      SITE_AUTH_TOKEN: ${{ secrets.SITE_AUTH_TOKEN }}

Relevance

●●● Strong

Explicit repository rule limits titles to 72 chars; deterministic compliance violation.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 2826345 requires PR titles to be 72 characters or fewer; the current PR title is 91
characters long.

Rule 2826345: Limit pull request titles to 72 characters or fewer

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR title exceeds the 72 character limit.

## Issue Context
Current title: `Rename PANGOLIN_ACCESS_TOKEN_ID/PANGOLIN_ACCESS_TOKEN to SITE_AUTH_TOKEN_ID/SITE_AUTH_TOKEN` (91 chars).

## Fix Focus Areas
- .github/workflows/deploy-site.yml[69-70]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. PR title not title case ✗ Dismissed 📘 Rule violation ✧ Quality

Description

The PR title uses all-caps token words (e.g., PANGOLIN_ACCESS_TOKEN_ID) rather than title case for
non-bind words. This violates the enforced title-case convention and makes titles harder to scan
consistently.

Code

.github/workflows/deploy-site.yml[R69-70]

+      SITE_AUTH_TOKEN_ID: ${{ secrets.SITE_AUTH_TOKEN_ID }}
+      SITE_AUTH_TOKEN: ${{ secrets.SITE_AUTH_TOKEN }}

Relevance

●●● Strong

Explicit repository title-case rule; deterministic compliance violation on all-caps tokens.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 2826395 requires title case capitalization rules in the PR title; the current title
includes all-caps token-words that are not in title case.

Rule 2826395: Enforce title case in pull request titles with short bind words in lowercase

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR title does not follow the required title case rules (non-bind words must be Title Case; bind words like `to` must be lowercase).

## Issue Context
Consider a title like: `Rename Pangolin Access Token Secrets to Site Auth Token Secrets` (or similar) to avoid all-caps token-words in the title.

## Fix Focus Areas
- .github/workflows/deploy-site.yml[69-70]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 13 rules

Review mode: ⚖️ Balanced: This changes live deployment workflow secret mappings and related operational documentation; the localized rename is low-density, but runtime configuration and secret-handling impact warrant the default careful review.

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗