Share resource bundle via organization secret

.github/workflows/test.yml

@@ -20,9 +20,11 @@ concurrency:
 
 # Test data (recipes superproject resource/shared) ships as an encrypted
 # bundle, tests/resources.tar.xz.asc (tar.xz, AES-256, ASCII-armored).
-# The passphrase lives in the RESOURCES_PASSPHRASE repository secret.
-# To rotate: run `snip bundle` with a fresh passphrase and set
-# the secret to the same value (see `snip bundle --help`).
+# The passphrase lives in the RESOURCES_PASSPHRASE organization secret,
+# shared by the clojure/python/ocaml snippet repos (one passphrase,
+# identical bundles). To rotate: run `snip bundle` with a fresh
+# passphrase, set the organization secret to the same value, and
+# rebuild the sibling bundles too (see `snip bundle --help`).
 
 # The perf-callgrind native leg always builds clojure-rs master HEAD
 # (interpreter-only build; `run` needs no LLVM), resolved once per

README.md

@@ -28,7 +28,7 @@ For automated validation, the shared test cases from the recipes superproject (`
 
 ### CI/CD Pipeline
 
-`.github/workflows/test.yml` validates the snippets on push to `master`, pull requests, and manual dispatch. It downloads the Clojure jars, decrypts the bundle with the `RESOURCES_PASSPHRASE` repository secret, builds the `snip` tool once (cached per source hash), and runs:
+`.github/workflows/test.yml` validates the snippets on push to `master`, pull requests, and manual dispatch. It downloads the Clojure jars, decrypts the bundle with the `RESOURCES_PASSPHRASE` organization secret (shared with the python/ocaml snippet repos), builds the `snip` tool once (cached per source hash), and runs:
 
 ```sh
 snip test --resources tests/resources --jobs 4 --timeout 300

scripts/ci/go/cmd/snip/bundle.go

@@ -15,7 +15,9 @@ superproject, and print the rotation instructions.
 Usage: snip bundle <resource/shared dir> [passphrase-file]
 
 With no passphrase file, a fresh 64-char passphrase is generated and
-printed ONCE (save it, then set it as the RESOURCES_PASSPHRASE secret).
+printed ONCE (save it, then set it as the RESOURCES_PASSPHRASE
+organization secret, shared by the clojure/python/ocaml snippet repos;
+rebuild their bundles too).
 With a passphrase file, the bundle is re-encrypted under the existing
 secret value (use after resource/shared changes, no rotation needed).
 

scripts/ci/go/internal/bundle/bundle.go

@@ -79,7 +79,7 @@ func Build(root, sharedDir, passFile string) (*Result, error) {
 func (r *Result) Report() string {
 	out := fmt.Sprintf("wrote %s (%d bytes)\n", r.Out, r.Bytes)
 	if r.Fresh {
-		out += "FRESH PASSPHRASE (set as RESOURCES_PASSPHRASE, then destroy this copy):\n" +
+		out += "FRESH PASSPHRASE (set as org secret RESOURCES_PASSPHRASE, then destroy this copy):\n" +
 			r.Passphrase + "\n"
 	}
 	return out