deployment-toolkit/examples/secrets.md

Consuming Repository Configuration

Laravel deployment variables

SERVER_DEPLOY_ROOT=/opt/1panel/apps/openresty/openresty/www/sites/example.com/index
SERVER_CONTAINER_DEPLOY_ROOT=/www/sites/example.com/index
SERVER_PHP_CONTAINER=php82-example
SERVER_HEALTHCHECK_URL=https://example.com/up

Laravel deployment secret:

SERVER_BACKUP_COMMAND=/usr/local/sbin/backup-example-database

The command should be a root-owned server-side wrapper. Do not put database passwords directly in a workflow.

Mini Program variables

MINIAPP_APPID=wx0000000000000000
MINIAPP_API_URL=https://example.com/api
MINIAPP_ROBOT=1

Mini Program secret:

WECHAT_CI_PRIVATE_KEY=<complete code-upload private key>

Add the Runner's fixed public egress IP to the WeChat code-upload whitelist.

Production Runner

Register a repository-scoped host Runner label named production. Pull-request workflows must not use this label or access production secrets.