SatoshiQaziMuhammed 093f6a15dc fix(host,sync): publish lists readable by nginx, and push the sync over a deploy key (#5) ...

The first publish on phishing.pezkuwichain.io copied the stage directory's
0700 mode onto the web root with rsync -a, and every list answered 403 until
the modes were put back by hand, about three minutes later. The publish script
now sets modes (--chmod=D755,F644), and test-publish.sh checks the web root's
directories are 755 and the lists 644; without --chmod it fails.

master is now protected by a ruleset (pull request, "lists" required). GitHub
refuses the Actions app as a bypass actor, so the sync's github.token push
would have been rejected. The sync now pushes over a write deploy key, the
repository's only one, kept as a secret of a "sync" environment that runs for
master only; the ruleset exempts deploy keys. GitHub's host keys are pinned
in pezkuwi/github_host_keys, and the job's token drops to contents: read.

2026-09-13 17:39:09 +04:00

..

host

fix(host,sync): publish lists readable by nginx, and push the sync over a deploy key (#5)

2026-09-13 17:39:09 +04:00

github_host_keys

fix(host,sync): publish lists readable by nginx, and push the sync over a deploy key (#5)

2026-09-13 17:39:09 +04:00

overlay.json

Sync the lists with polkadot-js/phishing every day, and publish them with checks (#4)

2026-09-13 17:34:51 +04:00

upstream.json

Sync the lists with polkadot-js/phishing every day, and publish them with checks (#4)

2026-09-13 17:34:51 +04:00