From 9841ddc4a9a86efd0725554afefa0bbb36ada387 Mon Sep 17 00:00:00 2001 From: teahub Date: Wed, 28 Oct 2026 13:10:18 -0700 Subject: [PATCH] wk-card: set our own trust cards (links, answer, vouch), signing inside Actions Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UozKbNTNSfntAfsaaFuLuM --- .gitea/workflows/wk-card.yml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .gitea/workflows/wk-card.yml diff --git a/.gitea/workflows/wk-card.yml b/.gitea/workflows/wk-card.yml new file mode 100644 index 0000000..6d3a584 --- /dev/null +++ b/.gitea/workflows/wk-card.yml @@ -0,0 +1,36 @@ +name: wk-card +# Our own trust cards on well-known.online: links, a fresh signed answer, and vouches between our names. +# Signs inside Actions with the name's main key: factory = SNAIL_KNOWN (uniqornlabz, get), well-known = WK_NSEC. +on: + workflow_dispatch: + inputs: + key: { description: "which key signs: factory or well-known", required: true, default: factory } + name: { description: "the signing name (e.g. uniqornlabz)", required: true } + action: { description: "answer | links | vouch", required: true, default: answer } + args: { description: "links: space-separated https URLs; vouch: target name, then the note", required: false, default: "" } +jobs: + card: + runs-on: ubuntu-latest + steps: + - name: run + env: + K_FACTORY: ${{ secrets.SNAIL_KNOWN }} + K_WK: ${{ secrets.WK_NSEC }} + WHICH: ${{ inputs.key }} + NAME: ${{ inputs.name }} + ACTION: ${{ inputs.action }} + ARGS: ${{ inputs.args }} + run: | + mkdir -p /tmp/wc && cd /tmp/wc + npm init -y >/dev/null && npm i --silent @noble/curves@2.4.0 >/dev/null + curl -fsSO https://well-known.online/card.mjs + umask 077 + case "$WHICH" in factory) printf '%s' "$K_FACTORY" > k ;; well-known) printf '%s' "$K_WK" > k ;; *) echo "key must be factory or well-known"; exit 2 ;; esac + export WK_NSEC_FILE=/tmp/wc/k + case "$ACTION" in + answer) node card.mjs "$NAME" answer ;; + links) set -f; node card.mjs "$NAME" links $ARGS ;; + vouch) T="${ARGS%% *}"; N="${ARGS#* }"; [ "$N" = "$ARGS" ] && N=""; node card.mjs "$NAME" vouch "$T" "$N" ;; + *) echo "action must be answer, links or vouch"; exit 2 ;; + esac + rm -f k