8251e59 · smbcloud/cli · siGit Code & Deploy

.agents/skills/ci-cd/SKILL.md

+14

@@ -622,6 +622,20 @@ When the main `README.MD` changes its tagline, logo URL, quick start commands, o

622 **Platform support table missing new targets**

623 When a new platform is added to any release matrix (e.g. `linux-arm64`), update the platform support table in `npm/smbcloud-cli/README.md` and `pypi/README.md` in the same PR.

624

625 +**Use workflow-level `env:` for compile-time secrets, not `$GITHUB_ENV` export steps**

626 +Compile-time secrets like `CLI_CLIENT_SECRET` (read by `env!()`) must be available to every `cargo` invocation across all platforms — including maturin-action's internal Docker containers (manylinux) and Windows subprocesses. Writing to `$GITHUB_ENV` in a separate step is unreliable: it does not propagate into Docker containers, and on Windows runners the default PowerShell shell does not expand `"$GITHUB_ENV"` correctly.

627 +

628 +The correct approach is to declare the secret in the workflow-level `env:` block, which GitHub Actions propagates to all jobs, all steps, and all subprocesses automatically:

629 +

630 +```yaml

631 +env:

632 + CLI_CLIENT_SECRET: ${{ secrets.CLI_CLIENT_SECRET }}

633 + CARGO_TERM_COLOR: always

634 + # ... other env vars

635 +```

636 +

637 +Never add a dedicated "Export build secret" step for this purpose. One line in `env:` replaces it entirely and works on Linux (including Docker), macOS, and Windows without any shell workarounds.

638 +

639 **PyPI blocks short and protocol-reserved package names**

640 PyPI maintains a blocklist of names that are too generic or conflict with well-known protocols and tools. `smb` is blocked because it is the name of the Windows SMB/CIFS file sharing protocol. Attempting to publish a package named `smb` returns `400 The name 'smb' isn't allowed`. There is no workaround — the name cannot be registered regardless of who owns it. If you need `uvx <name>` to work without `--from`, the package name and binary name must match AND the package name must not be on the blocklist. For this repo, `uvx --from smbcloud-cli smb` is the correct form.

641

.github/workflows/ci.yml

+1 -11

@@ -5,14 +5,7 @@ name: Tests

5 on: push

6

7 env:

8 - SMB_CLIENT_ID: ${{ secrets.SMB_CLIENT_ID }}

9 - SMB_CLIENT_SECRET: ${{ secrets.SMB_CLIENT_SECRET }}

10 - SMB_API_HOST: ${{ secrets.SMB_API_HOST }}

11 - SMB_API_PROTOCOL: ${{ secrets.SMB_API_PROTOCOL }}

12 - GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}

13 - GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}

14 - GH_OAUTH_REDIRECT_HOST: ${{ secrets.GH_OAUTH_REDIRECT_HOST }}

15 - GH_OAUTH_REDIRECT_PORT: ${{ secrets.GH_OAUTH_REDIRECT_PORT }}

8 + CLI_CLIENT_SECRET: ${{ secrets.CLI_CLIENT_SECRET }}

9

10 jobs:

11 test_branch:

@@ -21,7 +14,4 @@ jobs:

14 - uses: actions/checkout@v6

15 - uses: dtolnay/rust-toolchain@stable

16

24 - - name: Export build secret

25 - run: echo "CLI_CLIENT_SECRET=${{ secrets.CLI_CLIENT_SECRET }}" >> "$GITHUB_ENV"

26 -

17 - run: cargo test --all-features

.github/workflows/release-crate.yml

+1 -11

@@ -15,14 +15,7 @@ permissions:

15

16 env:

17 CARGO_TERM_COLOR: always

18 - SMB_CLIENT_ID: ${{ secrets.SMB_CLIENT_ID }}

19 - SMB_CLIENT_SECRET: ${{ secrets.SMB_CLIENT_SECRET }}

20 - SMB_API_HOST: ${{ secrets.SMB_API_HOST }}

21 - SMB_API_PROTOCOL: ${{ secrets.SMB_API_PROTOCOL }}

22 - GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}

23 - GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}

24 - GH_OAUTH_REDIRECT_HOST: ${{ secrets.GH_OAUTH_REDIRECT_HOST }}

25 - GH_OAUTH_REDIRECT_PORT: ${{ secrets.GH_OAUTH_REDIRECT_PORT }}

18 + CLI_CLIENT_SECRET: ${{ secrets.CLI_CLIENT_SECRET }}

19

20 jobs:

21 publish:

@@ -68,9 +61,6 @@ jobs:

61 with:

62 key: publish

63

71 - - name: Export build secret

72 - run: echo "CLI_CLIENT_SECRET=${{ secrets.CLI_CLIENT_SECRET }}" >> "$GITHUB_ENV"

73 -

64 - name: Verify Cargo.toml version matches tag

65 shell: bash

66 run: |

.github/workflows/release-github.yml

+1 -3

@@ -17,6 +17,7 @@ permissions:

17 env:

18 PROJECT_NAME: smb

19 CARGO_TERM_COLOR: always

20 + CLI_CLIENT_SECRET: ${{ secrets.CLI_CLIENT_SECRET }}

21

22 jobs:

23 build:

@@ -86,9 +87,6 @@ jobs:

87 with:

88 key: github-${{ matrix.target }}

89

89 - - name: Export build secrets

90 - run: echo "CLI_CLIENT_SECRET=${{ secrets.CLI_CLIENT_SECRET }}" >> "$GITHUB_ENV"

91 -

90 - name: Build binary

91 shell: bash

92 run: cargo build --locked --release --target ${{ matrix.target }} --package smbcloud-cli

.github/workflows/release-npm.yml

+1 -11

@@ -15,14 +15,7 @@ permissions:

15 contents: read

16

17 env:

18 - SMB_CLIENT_ID: ${{ secrets.SMB_CLIENT_ID }}

19 - SMB_CLIENT_SECRET: ${{ secrets.SMB_CLIENT_SECRET }}

20 - SMB_API_HOST: ${{ secrets.SMB_API_HOST }}

21 - SMB_API_PROTOCOL: ${{ secrets.SMB_API_PROTOCOL }}

22 - GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}

23 - GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}

24 - GH_OAUTH_REDIRECT_HOST: ${{ secrets.GH_OAUTH_REDIRECT_HOST }}

25 - GH_OAUTH_REDIRECT_PORT: ${{ secrets.GH_OAUTH_REDIRECT_PORT }}

18 + CLI_CLIENT_SECRET: ${{ secrets.CLI_CLIENT_SECRET }}

19

20 jobs:

21 publish-npm-binaries:

@@ -102,9 +95,6 @@ jobs:

95 rustup target add ${{ matrix.build.TARGET }} --toolchain ${{ env.RUST_TOOLCHAIN }}

96 rustup target list --installed

97

105 - - name: Export build secret

106 - run: echo "CLI_CLIENT_SECRET=${{ secrets.CLI_CLIENT_SECRET }}" >> "$GITHUB_ENV"

107 -

98 - name: Build

99 env:

100 GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}

.github/workflows/release-pypi.yml

+1 -14

@@ -12,14 +12,7 @@ permissions:

12

13 env:

14 CARGO_TERM_COLOR: always

15 - SMB_CLIENT_ID: ${{ secrets.SMB_CLIENT_ID }}

16 - SMB_CLIENT_SECRET: ${{ secrets.SMB_CLIENT_SECRET }}

17 - SMB_API_HOST: ${{ secrets.SMB_API_HOST }}

18 - SMB_API_PROTOCOL: ${{ secrets.SMB_API_PROTOCOL }}

19 - GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}

20 - GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}

21 - GH_OAUTH_REDIRECT_HOST: ${{ secrets.GH_OAUTH_REDIRECT_HOST }}

22 - GH_OAUTH_REDIRECT_PORT: ${{ secrets.GH_OAUTH_REDIRECT_PORT }}

15 + CLI_CLIENT_SECRET: ${{ secrets.CLI_CLIENT_SECRET }}

16

17 jobs:

18 build-wheels:

@@ -97,9 +90,6 @@ jobs:

90 rustup target add ${{ matrix.build.TARGET }} --toolchain ${{ env.RUST_TOOLCHAIN }}

91 rustup target list --installed

92

100 - - name: Export build secret

101 - run: echo "CLI_CLIENT_SECRET=${{ secrets.CLI_CLIENT_SECRET }}" >> "$GITHUB_ENV"

102 -

93 - name: Build wheel

94 uses: PyO3/maturin-action@v1

95 with:

@@ -152,9 +142,6 @@ jobs:

142 with:

143 toolchain: ${{ env.RUST_TOOLCHAIN }}

144

155 - - name: Export build secret

156 - run: echo "CLI_CLIENT_SECRET=${{ secrets.CLI_CLIENT_SECRET }}" >> "$GITHUB_ENV"

157 -

145 - name: Build sdist

146 uses: PyO3/maturin-action@v1

147 with:

crates/smbcloud-networking/src/constants.rs

-2

@@ -6,8 +6,6 @@ pub const GH_OAUTH_CLIENT_ID: &str = "bf1f12d97659a6495e43";

6 pub const GH_OAUTH_REDIRECT_HOST: &str = "http://localhost";

7 pub const GH_OAUTH_REDIRECT_PORT: &str = "8808";

8

9 -pub const SMB_CLIENT_ID: &str = "cli";

10 -pub const SMB_CLIENT_SECRET: &str = "secretttttttt";

9 pub const SMB_USER_AGENT: &str = "smbcloud-cli";

10

11 // Paths

cleanup