From 6315d4651dcc54c55fec07073af3046e00fe9b95 Mon Sep 17 00:00:00 2001
From: trevon <trevon@uccs.edu>
Date: Wed, 26 Aug 2026 01:25:42 +0000
Subject: [PATCH] use org actions secret for grading

---
 .forgejo/workflows/grade.yml | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/.forgejo/workflows/grade.yml b/.forgejo/workflows/grade.yml
index 7b6bf4d..9ae7e97 100644
--- a/.forgejo/workflows/grade.yml
+++ b/.forgejo/workflows/grade.yml
@@ -2,24 +2,23 @@ name: grade
 on: [push]
 
 # Production wiring (forgejo-runner on ghost):
-#   - forgejo-runner v13 config sets docker_host: automount (host socket into
-#     the job container), so docker_grade.sh drives the host daemon as designed
-#   - hidden tests mount from the runner host (/opt/grade-hidden) — never in
-#     this repo
-#   - GRADE_HMAC_SECRET mounts from /opt/grade/grade.env on the runner host
+#   - forgejo-runner v13: docker_host: automount -> the job container gets the
+#     host docker socket, so docker_grade.sh drives the host daemon as designed
+#   - hidden tests mount from the runner host via the nested docker run
+#     (-v /opt/grade-hidden/...) — never in this repo
+#   - GRADE_HMAC_SECRET is a Forgejo org/repo Actions secret (set via API),
+#     injected with ${{ secrets.GRADE_HMAC_SECRET }}
 jobs:
   grade:
     runs-on: docker
     container:
       image: gitea/runner-images:ubuntu-22.04
-      options: >-
-        -v /opt/grade/grade.env:/run/secrets/grade.env:ro
-        -v /opt/grade-hidden:/opt/grade-hidden:ro
     steps:
       - uses: actions/checkout@v4
       - name: Grade (blank fails, solved passes)
+        env:
+          GRADE_HMAC_SECRET: ${{ secrets.GRADE_HMAC_SECRET }}
         run: |
-          set -a; . /run/secrets/grade.env; set +a
           docker run --rm --network=none \
             -v "$PWD":/work \
             -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \