.env.sample

# Copy to .env and fill in real values:  cp .env.sample .env
#
# .env is read by scripts/deploy.sh at deploy time and pushed into the
# Cloudflare project (plain vars via `wrangler deploy --var`, secrets via
# `wrangler secret put`). .env itself is gitignored and never uploaded.

# ---------------------------------------------------------------------------
# Plain variable (visible in the Cloudflare dashboard)
# ---------------------------------------------------------------------------

# Comma-separated list of GitHub `release` actions to forward upstream.
# Anything not listed here is dropped -- e.g. with the value below, a
# "published" release is forwarded and an "edited" release is not.
#
# Valid release actions: published, unpublished, created, edited, deleted,
#                        prereleased, released
INCLUDED_ACTIONS=published,released

# ---------------------------------------------------------------------------
# Secrets (encrypted at rest, write-only in the Cloudflare dashboard)
# ---------------------------------------------------------------------------

# Destination that included deliveries are replayed to, byte-for-byte.
UPSTREAM_WEBHOOK_URL=https://example.com/hooks/github-releases

# The same secret you enter in GitHub's webhook settings. Used to verify the
# X-Hub-Signature-256 header; deliveries that fail the check are rejected 401.
# Generate one with: openssl rand -hex 32
GITHUB_WEBHOOK_SECRET=replace-me-with-a-random-32-byte-hex-string