fix(ci): remove from_secret to unblock pull_request pipelines

Woodpecker blocks from_secret on pull_request events. Move turbo
remote cache config to repository-level env vars in Woodpecker UI
instead. Pipeline runs with local cache if vars aren't set.

Fixes pipeline #163 secret error.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.woodpecker/ci.yml

@@ -5,9 +5,10 @@ variables:
 when:
   - event: [push, pull_request, manual]
 
-# Turbo remote cache is at turbo.mosaicstack.dev (ducktors/turborepo-remote-cache).
+# Turbo remote cache (turbo.mosaicstack.dev) is configured via Woodpecker
-# TURBO_TOKEN is a Woodpecker secret injected via from_secret into the environment.
+# repository-level environment variables (TURBO_API, TURBO_TEAM, TURBO_TOKEN).
-# Turbo picks up TURBO_API, TURBO_TOKEN, and TURBO_TEAM automatically.
+# This avoids from_secret which is blocked on pull_request events.
+# If the env vars aren't set, turbo falls back to local cache only.
 
 steps:
   install:
@@ -18,11 +19,6 @@ steps:
 
   typecheck:
     image: *node_image
-    environment:
-      TURBO_API: https://turbo.mosaicstack.dev
-      TURBO_TEAM: mosaic
-      TURBO_TOKEN:
-        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm typecheck
@@ -32,11 +28,6 @@ steps:
   # lint, format, and test are independent — run in parallel after typecheck
   lint:
     image: *node_image
-    environment:
-      TURBO_API: https://turbo.mosaicstack.dev
-      TURBO_TEAM: mosaic
-      TURBO_TOKEN:
-        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm lint
@@ -53,11 +44,6 @@ steps:
 
   test:
     image: *node_image
-    environment:
-      TURBO_API: https://turbo.mosaicstack.dev
-      TURBO_TEAM: mosaic
-      TURBO_TOKEN:
-        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm test
@@ -66,11 +52,6 @@ steps:
 
   build:
     image: *node_image
-    environment:
-      TURBO_API: https://turbo.mosaicstack.dev
-      TURBO_TEAM: mosaic
-      TURBO_TOKEN:
-        from_secret: turbo_token
     commands:
       - *enable_pnpm
       - pnpm build