From 0655626651e67d9e1c53d2dab6e16d76b0f6d436 Mon Sep 17 00:00:00 2001
From: Sepehr Sadri <sepehrsadri@gmail.com>
Date: Tue, 18 Aug 2026 23:59:25 +0200
Subject: [PATCH] ci: make workflows public-repo safe

- deploy-worker: manual trigger only (no auto-deploy of live infra from a public repo)
- health-check / ripe-atlas: drop schedule (avoid leaking live endpoints in public logs; run manually)
- release: fall back to GITHUB_TOKEN when RELEASE_TOKEN is unset
- commitlint: relax body/footer line length so Dependabot PRs pass
---
 .github/workflows/deploy-worker.yml    | 9 ++-------
 .github/workflows/health-check.yml     | 5 +++--
 .github/workflows/release.yml          | 3 ++-
 .github/workflows/ripe-atlas-check.yml | 4 ++--
 commitlint.config.js                   | 2 ++
 5 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/deploy-worker.yml b/.github/workflows/deploy-worker.yml
index b0d309f..eb0af9d 100644
--- a/.github/workflows/deploy-worker.yml
+++ b/.github/workflows/deploy-worker.yml
@@ -1,13 +1,8 @@
 name: Deploy — Smart-Sub Worker
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - "tools/smart-sub/src/**"
-      - "tools/smart-sub/wrangler.toml"
-      - "tools/backup-sub/**"
-      - "config/**"
+  # Auto-deploy on push is intentionally disabled for the public repo — deploying
+  # live infrastructure is a manual, credentialed action. Trigger by hand instead.
   workflow_call:
   workflow_dispatch:
     inputs:
diff --git a/.github/workflows/health-check.yml b/.github/workflows/health-check.yml
index 2125b63..c25dcb7 100644
--- a/.github/workflows/health-check.yml
+++ b/.github/workflows/health-check.yml
@@ -1,8 +1,9 @@
 name: VPN Health Check
 
 on:
-  schedule:
-    - cron: '*/30 * * * *'  # Every 30 minutes
+  # Scheduled monitoring is disabled on the public repo: run logs would expose
+  # live endpoints, and public cron auto-disables after 60 days. Run by hand,
+  # or move monitoring to a private repo / external scheduler.
   workflow_dispatch: {}       # Manual trigger
 
 jobs:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c61f3dd..3fd635c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,4 +20,5 @@ jobs:
           release-type: node
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
-          token: ${{ secrets.RELEASE_TOKEN }}
+          # Fall back to the built-in token when no PAT is configured.
+          token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ripe-atlas-check.yml b/.github/workflows/ripe-atlas-check.yml
index 2a0ce2c..c4a4d5d 100644
--- a/.github/workflows/ripe-atlas-check.yml
+++ b/.github/workflows/ripe-atlas-check.yml
@@ -1,8 +1,8 @@
 name: RIPE Atlas Iran Monitor
 
 on:
-  schedule:
-    - cron: '0 */6 * * *'  # Every 6 hours
+  # Scheduled monitoring is disabled on the public repo (run logs would expose
+  # measurement targets). Trigger manually, or run it from a private repo.
   workflow_dispatch:
     inputs:
       measurement_ids:
diff --git a/commitlint.config.js b/commitlint.config.js
index 7cac286..5e70978 100644
--- a/commitlint.config.js
+++ b/commitlint.config.js
@@ -21,5 +21,7 @@ export default {
       ],
     ],
     "subject-case": [0], // Allow any case in subject
+    "body-max-line-length": [0], // Allow long lines (URLs, Dependabot bodies)
+    "footer-max-line-length": [0],
   },
 };