modelcontextprotocol/actions
Watch
1
0
Fork
You've already forked actions
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document required secrets in action READMEs

Browse source 
- cloudflare-pages-preview/README.md: add dedicated Required secrets section
  listing the CF API token (with minimum permission scope) and account ID,
  which inputs they map to, and a note that github-token needs no extra secret
- CLAUDE.md: make Required secrets a mandatory README section for new actions
This commit is contained in:
Den Delimarsky 2026-03-10 16:44:08 +00:00
commit 456bb1d1f6
No known key found for this signature in database
2 changed files with 23 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
CLAUDE.md
View file

@ -116,10 +116,12 @@ Each action (or group) must have a `README.md` covering:
1. **What it does** — one paragraph per action 1. **What it does** — one paragraph per action
2. **Prerequisites** — external resources that must exist (CF project, etc.) 2. **Prerequisites** — external resources that must exist (CF project, etc.)
3. **Caller requirements** — `permissions:`, fork-PR guards, concurrency, 3. **Required secrets** — dedicated section listing every secret the caller
required secrets must configure: what it is, minimum permission scope, and which action
4. **Usage** — a minimal but complete caller workflow example input it maps to. If no secrets are needed, state that explicitly.
5. **Inputs/outputs** — tables with name, required, default, description 4. **Caller requirements** — `permissions:`, fork-PR guards, concurrency
5. **Usage** — a minimal but complete caller workflow example
6. **Inputs/outputs** — tables with name, required, default, description
## Registering the action ## Registering the action

20
cloudflare-pages-preview/README.md
View file

@ -21,9 +21,23 @@ and cleaning them up when the PR closes.
- A **Cloudflare Pages project** must be created in the Cloudflare dashboard - A **Cloudflare Pages project** must be created in the Cloudflare dashboard
first. Pass its name as `project-name`. first. Pass its name as `project-name`.
- A **Cloudflare API token** with `Pages:Edit` permission scoped to that - Two GitHub Actions secrets (see below).
project. Do not reuse a general-purpose token.
- GitHub Actions secrets for the token and account ID. ## Required secrets
Configure these in the caller repo (**Settings → Secrets and variables →
Actions**) and pass them to the action via `with:`:
| Secret | Passed as | What it is |
|---|---|---|
| Cloudflare API token | `api-token` | Token with **`Pages:Edit`** permission scoped **only** to the target Pages project. Do not reuse a general-purpose or account-wide Cloudflare token — create a dedicated token per project. |
| Cloudflare account ID | `account-id` | Found in the Cloudflare dashboard sidebar. Not actually secret, but stored as one to co-locate with the token. |
Both actions require the same two secrets.
The default `github-token` (`${{ github.token }}`) is sufficient for PR
commenting with the standard `pull-requests: write` permission — no additional
secret is needed there unless you want to comment as a different identity.
## Caller workflow requirements ## Caller workflow requirements