From 58225386b0e4e6049902dc88e4ed98bfa964e596 Mon Sep 17 00:00:00 2001
From: Bendik Aagaard Lynghaug <bendik.lynghaug@gmail.com>
Date: Wed, 23 Sep 2026 12:27:36 +0200
Subject: [PATCH] deploy: carry KANIDM_API_TOKEN into the instance env

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH
---
 .gitea/workflows/deploy.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ba580d9..86b0a8b 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -58,6 +58,10 @@ jobs:
           KANIDM_URL=${{ vars.KANIDM_URL }}
           OAUTH2_CLIENT_ID=${{ vars.OAUTH2_CLIENT_ID }}
           OAUTH2_CLIENT_SECRET=${{ secrets.OAUTH2_CLIENT_SECRET }}
+          # Onboarding from a desk (portal 0.3.40+, `invite:` alternatives): a
+          # Kanidm service-account token in idm_people_on_boarding. Empty
+          # means invites are not configured on this instance.
+          KANIDM_API_TOKEN=${{ secrets.KANIDM_API_TOKEN }}
           PUBLIC_URL=${{ vars.PUBLIC_URL }}
           COOKIE_SECURE=true
           # This repo is its own instance's content source.