[thdxr]

• v1 workflows now read their secrets from aws secrets manager over github oidc. deploy.yml assumes arn:aws:iam::604439173067:role/github/opencode-v1 in the v1 environment and fetches opencode/v1/{CLOUDFLARE_API_TOKEN,SENTRY_AUTH_TOKEN}.
• publish.yml assumes arn:aws:iam::604439173067:role/github/opencode-release in the release environment: opencode/release/{OPENCODE_API_KEY,SENTRY_AUTH_TOKEN,RELEASE_TAG_KEY,DISCORD_WEBHOOK} and shared/{APPLE_SIGNING_CERTIFICATE,APPLE_NOTARY_KEY,AUR_SSH_KEY,HOMEBREW_TAP_DEPLOY_KEY}. AUR_SSH_KEY is aliased back to AUR_KEY, which the scripts read.
• the AZURE_* trusted signing ids are repo variables now.
• RELEASE_TAG_KEY is fetched before the checkout in the publish job, because it is that checkout's ssh-key.
• the aws steps in version carry the same condition as its environment: (inputs.bump || inputs.version), so a push preview never tries to assume the role.
• dropped TAURI_SIGNING_PRIVATE_KEY(_PASSWORD): neither is set anywhere, and script/publish.ts already skips latest.json and logs that.
• moved the discord post from notify-discord.yml into the end of the publish job. a release event runs with a tag ref and the release environment only allows the dev and v1 branches, so that workflow could never assume the role. it now reads opencode/release/DISCORD_WEBHOOK and hands the release name, body and url to the same action.
• no v1 job uploads to r2, so the lib.sh unset fix from ci: read deploy and release secrets from aws secrets manager #62954 has no v1 equivalent.
• deleted unlock.yml: it reads vars.AWS_DEPLOY_ROLE_ARN and the stripe secrets, none of which exist.
• deleted publish-vscode.yml: VSCE_PAT and OPENVSX_TOKEN are not set, and no run under that name ever used this file (the v1 copy's Require a v1 commit step appears in none of its runs), so v1's copy has never run.
• deleted the event-driven bot copies (opencode.yml, triage.yml, duplicate-issues.yml, review.yml, pr-management.yml, docs-update.yml, stats.yml). issues, issue_comment, pull_request_target and schedule only run the workflow file from the default branch, and gh run list shows all of their runs on dev.
• the only secrets. references left on v1 are secrets.GITHUB_TOKEN.

unused once this and #62954 are both merged, since dev and v1 then read aws:

• repo: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID, AZURE_TRUSTED_SIGNING_ACCOUNT_NAME, AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE, AZURE_TRUSTED_SIGNING_ENDPOINT, DISCORD_WEBHOOK, OPENCODE_API_KEY, PLANETSCALE_SERVICE_TOKEN, PLANETSCALE_SERVICE_TOKEN_NAME
• env dev: CLOUDFLARE_API_TOKEN
• env production: CLOUDFLARE_API_TOKEN
• env release: APPLE_NOTARY_KEY, APPLE_SIGNING_CERTIFICATE, CLOUDFLARE_API_TOKEN, HOMEBREW_TAP_DEPLOY_KEY, RELEASE_TAG_KEY
• env v1: CLOUDFLARE_API_TOKEN

keeps:

• org AUR_KEY: sst, opentunnel, torpedo and the pulumi-* repos still use it.
• repo SENTRY_AUTH_TOKEN: dev deploy.yml still passes it for the beta stage, which has no branch.

— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊