deploy: carry KANIDM_API_TOKEN into the instance env

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH
2026-09-23 12:27:36 +02:00
parent 2d4f46d152
commit 0a51852cb2
1 changed files with 4 additions and 0 deletions
@@ -57,6 +57,10 @@ jobs:
          KANIDM_URL=${{ vars.KANIDM_URL }}
          OAUTH2_CLIENT_ID=${{ vars.OAUTH2_CLIENT_ID }}
          OAUTH2_CLIENT_SECRET=${{ secrets.OAUTH2_CLIENT_SECRET }}
+          # Onboarding from a desk (portal 0.3.40+, `invite:` alternatives): a
+          # Kanidm service-account token in idm_people_on_boarding. Empty
+          # means invites are not configured on this instance.
+          KANIDM_API_TOKEN=${{ secrets.KANIDM_API_TOKEN }}
          PUBLIC_URL=${{ vars.PUBLIC_URL }}
          COOKIE_SECURE=true
          # This repo is its own instance's content source; branding