chore: pin the plugin signing key and use TERMIX_PAT in workflows

.github/workflows/beta-release.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Resolve newest dev branch and compute beta version
         id: dev
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           REFS=$(gh api "repos/${{ github.repository }}/branches" --paginate -q '.[].name')
           if DEV_BRANCH=$(printf '%s\n' "$REFS" | node scripts/latest-dev-branch.cjs 2>/dev/null); then
@@ -106,7 +106,7 @@ jobs:
       - name: Resolve previous beta commit
         id: prev
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           SHA="${{ needs.prep.outputs.sha }}"
           PREV_SHA=$(gh release view beta --repo ${{ github.repository }} --json targetCommitish -q .targetCommitish 2>/dev/null || true)
@@ -161,7 +161,7 @@ jobs:
 
       - name: Create or update rolling beta release
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           TAG="beta"
           TITLE="Beta (rolling) - ${{ needs.prep.outputs.beta_version }}"

.github/workflows/crowdin-sync.yml

@@ -31,7 +31,7 @@ jobs:
         with:
           ref: ${{ steps.branch.outputs.name }}
           fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
+          token: ${{ secrets.TERMIX_PAT }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v7

.github/workflows/dependabot-retarget.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Resolve newest dev branch
         id: dev
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           REFS=$(gh api "repos/${{ github.repository }}/branches" --paginate -q '.[].name')
           # The helper exits non-zero when no dev-X.Y.Z branch exists; treat that
@@ -37,7 +37,7 @@ jobs:
       - name: Retarget and merge Dependabot PRs
         if: ${{ steps.dev.outputs.branch != '' }}
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
           DEV_BRANCH: ${{ steps.dev.outputs.branch }}
           REPO: ${{ github.repository }}
         run: |

.github/workflows/docker.yml

@@ -100,7 +100,7 @@ jobs:
         with:
           registry: ghcr.io
           username: lukegus
-          password: ${{ secrets.GHCR_TOKEN }}
+          password: ${{ secrets.TERMIX_PAT }}
 
       - name: Login to Docker Hub (prod and beta only)
         if: ${{ (inputs.build_type == 'Production' || inputs.build_type == 'Beta') && !inputs.dry_run }}

.github/workflows/release.yml

@@ -89,7 +89,7 @@ jobs:
         with:
           ref: ${{ needs.prep.outputs.dev_branch }}
           fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
+          token: ${{ secrets.TERMIX_PAT }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v7
@@ -146,7 +146,7 @@ jobs:
         with:
           ref: ${{ needs.prep.outputs.dev_branch }}
           fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
+          token: ${{ secrets.TERMIX_PAT }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v7
@@ -164,7 +164,7 @@ jobs:
       - name: Clean up stale Crowdin git integration branch
         continue-on-error: true
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           PR_NUMBER=$(gh pr list --repo ${{ github.repository }} --head i18n_translate --state open --json number -q '.[0].number' || true)
           if [ -n "$PR_NUMBER" ]; then
@@ -247,7 +247,7 @@ jobs:
       - name: Open and squash-merge PR to main
         id: merge
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           DEV_BRANCH="${{ needs.prep.outputs.dev_branch }}"
           TITLE="release-${{ needs.prep.outputs.version }}"
@@ -318,7 +318,7 @@ jobs:
       - name: Clear existing release artifacts (overwrite mode)
         if: ${{ inputs.mode == 'Overwrite release' }}
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           TAG="${{ needs.prep.outputs.release_tag }}"
           if ! gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
@@ -341,7 +341,7 @@ jobs:
       - name: Create or update GitHub release
         if: ${{ inputs.mode != 'Overwrite release' }}
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           TAG="${{ needs.prep.outputs.release_tag }}"
           TITLE="release-${{ needs.prep.outputs.version }}"
@@ -384,7 +384,7 @@ jobs:
         with:
           ref: main
           fetch-depth: 1
-          token: ${{ secrets.GHCR_TOKEN }}
+          token: ${{ secrets.TERMIX_PAT }}
 
       - name: Bump and commit Homebrew cask
         env:
@@ -445,7 +445,7 @@ jobs:
           repository: Termix-SSH/Docs
           ref: main
           fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
+          token: ${{ secrets.TERMIX_PAT }}
           path: docs-repo
 
       - name: Create docs release branch
@@ -492,7 +492,7 @@ jobs:
         if: ${{ inputs.mode != 'Dry run' }}
         working-directory: docs-repo
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           BRANCH="dev-${{ needs.prep.outputs.version }}"
           if ! git ls-remote --exit-code origin "refs/heads/$BRANCH" >/dev/null 2>&1; then
@@ -560,14 +560,14 @@ jobs:
 
       - name: Delete dev branch in Termix
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
-          git push https://x-access-token:${{ secrets.GHCR_TOKEN }}@github.com/${{ github.repository }}.git \
+          git push https://x-access-token:${{ secrets.TERMIX_PAT }}@github.com/${{ github.repository }}.git \
             --delete "${{ needs.prep.outputs.dev_branch }}" || true
 
       - name: Delete dev branch in Docs
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
-          git push https://x-access-token:${{ secrets.GHCR_TOKEN }}@github.com/Termix-SSH/Docs.git \
+          git push https://x-access-token:${{ secrets.TERMIX_PAT }}@github.com/Termix-SSH/Docs.git \
             --delete "dev-${{ needs.prep.outputs.version }}" || true

src/backend/plugins/trust.ts

@@ -20,7 +20,13 @@ export interface TrustedPluginKey {
  *
  * Add a key with `termix-plugin keygen` (see the Termix-Registry README).
  */
-export const TRUSTED_PLUGIN_KEYS: readonly TrustedPluginKey[] = [];
+export const TRUSTED_PLUGIN_KEYS: readonly TrustedPluginKey[] = [
+  {
+    id: "ec40e29bcc4986b2",
+    publicKey: "rF6ouWTnuLgnZi7yemr+yhZmMxvNMvgro1Mf05IkSGo=",
+    addedIn: "26.10.0",
+  },
+];
 
 export type ArtifactVerification =
   { ok: true; keyId: string } | { ok: false; reason: string };