From ab381ac1075549af8835a8aee5197d0053af4061 Mon Sep 17 00:00:00 2001 From: Pigbibi Date: Sat, 10 Oct 2026 22:13:41 +0900 Subject: [PATCH] ops: bot identity check reads repo-level TG_TOKEN without binance-runtime env --- .github/workflows/notify-bot-identity.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/notify-bot-identity.yml b/.github/workflows/notify-bot-identity.yml index 447a1fc7..d7a6104c 100644 --- a/.github/workflows/notify-bot-identity.yml +++ b/.github/workflows/notify-bot-identity.yml @@ -1,7 +1,8 @@ name: Notify Bot Identity (read-only) # Resolves the Telegram token the Binance runtime would use (main.yml deploy job: -# environment binance-runtime, secrets.TG_TOKEN) to its public bot id/username via +# secrets.TG_TOKEN, a repo-level secret; binance-runtime only holds other secrets +# and is restricted to runtime-production, so this job does not bind it) to its public bot id/username via # getMe, and compares it with the unified QSL资产管家 bot (8334367951). # Prints only bot id / username; never prints token or chat id; sends no message; # does not re-enable main.yml or change any secret. @@ -16,7 +17,6 @@ jobs: name: TG_TOKEN bot identity (read-only) runs-on: ubuntu-latest timeout-minutes: 5 - environment: binance-runtime env: TG_TOKEN: ${{ secrets.TG_TOKEN }} TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}