• English

      • Storage location

      Comments can live in the same repository that runs the comment system, or in a separate one. COMMENTS_REPO decides; there is no extra switch.

      COMMENTS_REPO=owner/comments-repo   # recommended
COMMENTS_REPO=owner/gitpigeon    # same repo as the service

      Prefer a separate repository

      Both work, but they are not equivalent.

      1. Blast radius

      • Separate repo: a leaked PAT can write junk files into the comments repo
      • Same repo: a leaked PAT can push code into the repository that runs this function. Platform Git integration redeploys, and the attacker gains the runtime with every environment variable, including GITHUB_TOKEN and COMMENTS_SECRET

      2. Self redeploys

      Git integration watches pushes, not code changes. Every approval triggers a rebuild. Harmless, but it burns build minutes.

      Ways to skip the rebuild:

      PlatformMechanism
      VercelIgnored Build Step that skips when only comments/ changed
      Netlifyignore build command with the same check
      Cloudflare PagesBuild watch paths excluding comments/*
      Cloudflare Workers (wrangler)No Git integration, no rebuild at all

      3. Hard rule

      Builds must never write back to the repository. Writes happen only in the approve action. Otherwise same-repo mode becomes an infinite deploy loop.

      Same-repo warning

      Set SELF_REPO to receive sameRepo: true plus a warning from /api/health. Leave it unset to skip the comparison.

      Transparent to clients

      Same or separate, private or public: the widget configuration is identical. Only the server-side COMMENTS_REPO changes.