From e627d3c6fb3403114a05ef36491003bc0d0efc1a Mon Sep 17 00:00:00 2001
From: LizardByte-bot <108553330+LizardByte-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 14:22:16 +0000
Subject: [PATCH 1/8] chore: update global workflows

---
 .github/workflows/_codeql.yml      | 11 ++++++-----
 .github/workflows/_common-lint.yml |  5 +++--
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/_codeql.yml b/.github/workflows/_codeql.yml
index 15c5a6f60e7..5569a2ed7c0 100644
--- a/.github/workflows/_codeql.yml
+++ b/.github/workflows/_codeql.yml
@@ -4,16 +4,13 @@
 # the above-mentioned repo.
 
 name: CodeQL
-permissions:
-  actions: read
-  contents: read
-  security-events: write
+permissions: {}
 
 on:
+  pull_request:
   push:
     branches:
       - master
-  pull_request:
   schedule:
     - cron: '00 12 * * 0'  # every Sunday at 12:00 UTC
 
@@ -26,3 +23,7 @@ jobs:
     name: CodeQL
     uses: LizardByte/.github/.github/workflows/__call-codeql.yml@master
     if: ${{ github.repository != 'LizardByte/.github' }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
diff --git a/.github/workflows/_common-lint.yml b/.github/workflows/_common-lint.yml
index 80be0ccfd25..e7760cbc06f 100644
--- a/.github/workflows/_common-lint.yml
+++ b/.github/workflows/_common-lint.yml
@@ -4,8 +4,7 @@
 # the above-mentioned repo.
 
 name: common lint
-permissions:
-  contents: read
+permissions: {}
 
 on:
   pull_request:
@@ -19,3 +18,5 @@ jobs:
     name: Common Lint
     uses: LizardByte/.github/.github/workflows/__call-common-lint.yml@master
     if: ${{ github.repository != 'LizardByte/.github' }}
+    permissions:
+      contents: read

From 2c861a1aa2f76cf2097d639bd33576b1d9c8536d Mon Sep 17 00:00:00 2001
From: LizardByte-bot <108553330+LizardByte-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 14:25:57 +0000
Subject: [PATCH 2/8] chore: update global workflows

---
 .github/workflows/_update-docs.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/_update-docs.yml b/.github/workflows/_update-docs.yml
index 6dd66c55e34..863f92d5e51 100644
--- a/.github/workflows/_update-docs.yml
+++ b/.github/workflows/_update-docs.yml
@@ -28,6 +28,7 @@ jobs:
     name: Update docs
     uses: LizardByte/.github/.github/workflows/__call-update-docs.yml@master
     if: github.repository_owner == 'LizardByte'
+    permissions: {}
     with:
       readthedocs_slug: ${{ vars.READTHEDOCS_SLUG }}
     secrets:

From b2d1dc4aaf74acecb598e3abf56d1be03be64b69 Mon Sep 17 00:00:00 2001
From: LizardByte-bot <108553330+LizardByte-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 14:26:56 +0000
Subject: [PATCH 3/8] chore: update global workflows

---
 .github/workflows/_update-flathub-repo.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/_update-flathub-repo.yml b/.github/workflows/_update-flathub-repo.yml
index 35286db9141..e9d1050dd0e 100644
--- a/.github/workflows/_update-flathub-repo.yml
+++ b/.github/workflows/_update-flathub-repo.yml
@@ -8,8 +8,7 @@
 # Update Flathub on release events.
 
 name: Update Flathub repo
-permissions:
-  contents: read
+permissions: {}
 
 on:
   release:
@@ -25,7 +24,10 @@ jobs:
     name: Update Flathub Repo
     uses: LizardByte/.github/.github/workflows/__call-update-flathub-repo.yml@master
     if: github.repository_owner == 'LizardByte'
+    permissions:
+      contents: read
+    with:
+      gh_name: ${{ vars.GH_BOT_NAME }}
     secrets:
       GH_EMAIL: ${{ secrets.GH_BOT_EMAIL }}
-      GH_NAME: ${{ secrets.GH_BOT_NAME }}
       GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}

From 4adcd4048a67fb238fbf426fc781304c0c2e7ba7 Mon Sep 17 00:00:00 2001
From: LizardByte-bot <108553330+LizardByte-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 14:27:05 +0000
Subject: [PATCH 4/8] chore: update global workflows

---
 .github/workflows/_update-homebrew-repo.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/_update-homebrew-repo.yml b/.github/workflows/_update-homebrew-repo.yml
index 947c78722bb..7b07b4e5414 100644
--- a/.github/workflows/_update-homebrew-repo.yml
+++ b/.github/workflows/_update-homebrew-repo.yml
@@ -8,8 +8,7 @@
 # Update Homebrew on release events.
 
 name: Update Homebrew repo
-permissions:
-  contents: read
+permissions: {}
 
 on:
   release:
@@ -25,7 +24,10 @@ jobs:
     name: Update Homebrew repo
     uses: LizardByte/.github/.github/workflows/__call-update-homebrew-repo.yml@master
     if: github.repository_owner == 'LizardByte'
+    permissions:
+      contents: read
+    with:
+      gh_username: ${{ vars.GH_BOT_NAME }}
     secrets:
       GH_EMAIL: ${{ secrets.GH_BOT_EMAIL }}
-      GH_USERNAME: ${{ secrets.GH_BOT_NAME }}
       GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}

From b775a4f7994e4e10ce709d76d35de539925bb28f Mon Sep 17 00:00:00 2001
From: LizardByte-bot <108553330+LizardByte-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 14:27:14 +0000
Subject: [PATCH 5/8] chore: update global workflows

---
 .github/workflows/_update-pacman-repo.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/_update-pacman-repo.yml b/.github/workflows/_update-pacman-repo.yml
index 56e8c06421f..ca464678c3b 100644
--- a/.github/workflows/_update-pacman-repo.yml
+++ b/.github/workflows/_update-pacman-repo.yml
@@ -8,8 +8,7 @@
 # Update pacman repo on release events.
 
 name: Update pacman repo
-permissions:
-  contents: read
+permissions: {}
 
 on:
   release:
@@ -25,7 +24,10 @@ jobs:
     name: Update pacman repo
     uses: LizardByte/.github/.github/workflows/__call-update-pacman-repo.yml@master
     if: github.repository_owner == 'LizardByte'
+    permissions:
+      contents: read
+    with:
+      gh_name: ${{ vars.GH_BOT_NAME }}
     secrets:
       GH_EMAIL: ${{ secrets.GH_BOT_EMAIL }}
-      GH_NAME: ${{ secrets.GH_BOT_NAME }}
       GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}

From 908a1a346a527877506a3754074f09a02ed198c1 Mon Sep 17 00:00:00 2001
From: LizardByte-bot <108553330+LizardByte-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 14:27:24 +0000
Subject: [PATCH 6/8] chore: update global workflows

---
 .github/workflows/_update-winget-repo.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/_update-winget-repo.yml b/.github/workflows/_update-winget-repo.yml
index 1cac56bfc2d..106a83bd7c6 100644
--- a/.github/workflows/_update-winget-repo.yml
+++ b/.github/workflows/_update-winget-repo.yml
@@ -8,8 +8,7 @@
 # Update Winget on release events.
 
 name: Update Winget repo
-permissions:
-  contents: read
+permissions: {}
 
 on:
   release:
@@ -25,5 +24,9 @@ jobs:
     name: Update Winget repo
     uses: LizardByte/.github/.github/workflows/__call-update-winget-repo.yml@master
     if: github.repository_owner == 'LizardByte'
+    permissions:
+      contents: read
+    with:
+      gh_name: ${{ vars.GH_BOT_NAME }}
     secrets:
       GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}

From 4cc5f4a23ae3b1fc918153db8bdde04d8890ab59 Mon Sep 17 00:00:00 2001
From: LizardByte-bot <108553330+LizardByte-bot@users.noreply.github.com>
Date: Sat, 14 Feb 2026 14:28:07 +0000
Subject: [PATCH 7/8] chore: update global workflows

---
 .github/workflows/_release-notifier.yml | 8 +++++---
 .github/workflows/_update-changelog.yml | 5 +++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/_release-notifier.yml b/.github/workflows/_release-notifier.yml
index 76ee855eecf..7a30fa1a356 100644
--- a/.github/workflows/_release-notifier.yml
+++ b/.github/workflows/_release-notifier.yml
@@ -6,8 +6,7 @@
 # Create a blog post for a new release and open a PR to the blog repo
 
 name: Release Notifications
-permissions:
-  contents: read
+permissions: {}
 
 on:
   release:
@@ -19,7 +18,10 @@ jobs:
     name: Update blog
     uses: LizardByte/.github/.github/workflows/__call-release-notifier.yml@master
     if: github.repository_owner == 'LizardByte'
+    permissions:
+      contents: read
+    with:
+      gh_name: ${{ vars.GH_BOT_NAME }}
     secrets:
       GH_EMAIL: ${{ secrets.GH_BOT_EMAIL }}
-      GH_NAME: ${{ secrets.GH_BOT_NAME }}
       GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
diff --git a/.github/workflows/_update-changelog.yml b/.github/workflows/_update-changelog.yml
index 283e7770a2b..314caf7ef30 100644
--- a/.github/workflows/_update-changelog.yml
+++ b/.github/workflows/_update-changelog.yml
@@ -4,8 +4,7 @@
 # the above-mentioned repo.
 
 name: Update changelog
-permissions:
-  contents: read
+permissions: {}
 
 on:
   release:
@@ -27,5 +26,7 @@ jobs:
       github.repository_owner == 'LizardByte' &&
       (github.event_name == 'workflow_dispatch' ||
       (!github.event.release.prerelease && !github.event.release.draft))
+    permissions:
+      contents: read
     secrets:
       GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}

From 227d08a674e57dc0164ca67181920cf5d009740f Mon Sep 17 00:00:00 2001
From: ReenigneArcher <42013603+ReenigneArcher@users.noreply.github.com>
Date: Sat, 14 Feb 2026 09:41:46 -0500
Subject: [PATCH 8/8] Use repo vars and inputs in GitHub workflows

Switch workflow configuration to use repository variables and workflow inputs instead of embedding certain secrets. Add a required git_username input to ci-homebrew and wire it into the homebrew job. Update ci.yml to pass docker_hub_username and gh_bot_name from inputs/vars and remove corresponding secret mappings. Replace secret-based DISCORD_USERNAME and GH_BOT_NAME usages with vars.DISCORD_USERNAME and vars.GH_BOT_NAME, and add gh_bot_name input to update-pages. This centralizes config in repo-level variables and reduces reliance on stored secrets; callers of these workflows must supply the new inputs or set the referenced repo vars.
---
 .github/workflows/ci-homebrew.yml                | 7 ++++---
 .github/workflows/ci.yml                         | 8 ++++----
 .github/workflows/release-notifier-moonlight.yml | 2 +-
 .github/workflows/update-pages.yml               | 2 +-
 4 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci-homebrew.yml b/.github/workflows/ci-homebrew.yml
index a4f9a8f74a2..b6a22f17f28 100644
--- a/.github/workflows/ci-homebrew.yml
+++ b/.github/workflows/ci-homebrew.yml
@@ -5,6 +5,9 @@ permissions: {}
 on:
   workflow_call:
     inputs:
+      git_username:
+        required: true
+        type: string
       publish_release:
         required: true
         type: string
@@ -22,8 +25,6 @@ on:
         required: true
       GIT_EMAIL:
         required: true
-      GIT_USERNAME:
-        required: true
 
 jobs:
   build_homebrew:
@@ -148,7 +149,7 @@ jobs:
           actionlint_config: "---\n# empty config"
           formula_file: ${{ github.workspace }}/homebrew/sunshine.rb
           git_email: ${{ secrets.GIT_EMAIL }}
-          git_username: ${{ secrets.GIT_USERNAME }}
+          git_username: ${{ inputs.git_username }}
           publish: false
           token: ${{ secrets.GH_TOKEN }}
           validate: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f3dcb5a5359..40a055747b6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,16 +50,16 @@ jobs:
       packages: write
     uses: LizardByte/.github/.github/workflows/__call-docker.yml@master
     with:
+      docker_hub_username: ${{ vars.DOCKER_HUB_USERNAME }}
+      gh_bot_name: ${{ vars.GH_BOT_NAME }}
       maximize_build_space: true
       publish_release: ${{ needs.release-setup.outputs.publish_release }}
       release_commit: ${{ needs.release-setup.outputs.release_commit }}
       release_tag: ${{ needs.release-setup.outputs.release_tag }}
       release_version: ${{ needs.release-setup.outputs.release_version }}
     secrets:
-      DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
       DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
       DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
-      GH_BOT_NAME: ${{ secrets.GH_BOT_NAME }}
       GH_BOT_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -80,6 +80,7 @@ jobs:
       contents: read
     uses: ./.github/workflows/ci-homebrew.yml
     with:
+      git_username: ${{ vars.GH_BOT_NAME }}
       publish_release: ${{ needs.release-setup.outputs.publish_release }}
       release_commit: ${{ needs.release-setup.outputs.release_commit }}
       release_tag: ${{ needs.release-setup.outputs.release_tag }}
@@ -87,7 +88,6 @@ jobs:
     secrets:
       GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
       GIT_EMAIL: ${{ secrets.GH_BOT_EMAIL }}
-      GIT_USERNAME: ${{ secrets.GH_BOT_NAME }}
 
   build-linux:
     name: Linux
@@ -312,7 +312,7 @@ jobs:
           actionlint_config: "---\n# empty config"
           formula_file: ${{ github.workspace }}/homebrew/sunshine-beta.rb
           git_email: ${{ secrets.GH_BOT_EMAIL }}
-          git_username: ${{ secrets.GH_BOT_NAME }}
+          git_username: ${{ vars.GH_BOT_NAME }}
           publish: true
           token: ${{ secrets.GH_BOT_TOKEN }}
           validate: false
diff --git a/.github/workflows/release-notifier-moonlight.yml b/.github/workflows/release-notifier-moonlight.yml
index 428f0f46bd3..f0c4864a086 100644
--- a/.github/workflows/release-notifier-moonlight.yml
+++ b/.github/workflows/release-notifier-moonlight.yml
@@ -35,5 +35,5 @@ jobs:
           nodetail: true
           nofail: false
           title: ${{ github.event.repository.name }} ${{ github.ref_name }} Released
-          username: ${{ secrets.DISCORD_USERNAME }}
+          username: ${{ vars.DISCORD_USERNAME }}
           webhook: ${{ secrets.DISCORD_RELEASE_WEBHOOK_MOONLIGHT }}
diff --git a/.github/workflows/update-pages.yml b/.github/workflows/update-pages.yml
index 74b4d7e3dd6..faa8ec5d7a8 100644
--- a/.github/workflows/update-pages.yml
+++ b/.github/workflows/update-pages.yml
@@ -38,9 +38,9 @@ jobs:
     uses: LizardByte/LizardByte.github.io/.github/workflows/jekyll-build.yml@master
     secrets:
       GH_BOT_EMAIL: ${{ secrets.GH_BOT_EMAIL }}
-      GH_BOT_NAME: ${{ secrets.GH_BOT_NAME }}
       GH_BOT_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
     with:
       clean_gh_pages: true
+      gh_bot_name: ${{ vars.GH_BOT_NAME }}
       site_artifact: 'prep'
       target_branch: 'gh-pages'