From b287728c19fda39ea8ca473c08574c683c690c94 Mon Sep 17 00:00:00 2001 From: wtclaude Date: Wed, 19 Aug 2026 20:46:18 -0500 Subject: [PATCH] ci(facts): use the existing org-level REGISTRY_TOKEN checkFacts needs to read link, servuo-plugins, website and installer, and the automatic per-run token is scoped to this repo alone. Rather than mint a new secret, the workflow uses REGISTRY_TOKEN, which already exists at the org level with the right permissions. The secret is named for the registry and the script reads GITEA_TOKEN; the mapping stays in the workflow so the script keeps asking for what it actually wants -- a Gitea token -- rather than this org's secret name. Co-Authored-By: Claude --- .gitea/workflows/pr-checks.yml | 10 +++++++--- README.md | 4 +++- scripts/checkFacts.mjs | 5 +++-- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/pr-checks.yml b/.gitea/workflows/pr-checks.yml index 746a01e..7bf328c 100644 --- a/.gitea/workflows/pr-checks.yml +++ b/.gitea/workflows/pr-checks.yml @@ -44,11 +44,15 @@ jobs: # # This needs a token that can read the OTHER repositories in the org: link, # servuo-plugins, website and installer. The automatic per-run token is scoped - # to this repository alone and will 404 on all four, so the job reads an - # org-level secret instead. + # to this repository alone and 404s on all four, so the job uses the org-level + # REGISTRY_TOKEN, which already exists and already carries the right scope. + # + # The secret is named for the registry; the script reads GITEA_TOKEN. Mapping it + # here rather than renaming either side keeps the script's interface honest — it + # wants a Gitea token, not this org's particular secret. # # It runs last, and it is the only step that touches the network, so a Gitea # outage cannot mask a real failure in the build. env: - GITEA_TOKEN: ${{ secrets.PLATFORM_READ_TOKEN }} + GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }} run: npm run check:facts diff --git a/README.md b/README.md index 49521f5..99c1c13 100644 --- a/README.md +++ b/README.md @@ -56,7 +56,9 @@ on protocol 3, because every checkout in the workspace sat on a feature branch w never been fetched. It needs a token — anonymous raw fetches fail on this Gitea instance, and a check that silently skips -itself is worse than no check at all. +itself is worse than no check at all. It must be able to read the other repositories in the +organisation, not just this one. CI already has this: the workflow maps the org-level +`REGISTRY_TOKEN` secret into `GITEA_TOKEN` for that step. **`checkTokens.mjs`** fails the build if a colour literal appears anywhere in `src/` outside `src/styles/tokens.css`. §7 promises that recolouring the site is a file copy and a container diff --git a/scripts/checkFacts.mjs b/scripts/checkFacts.mjs index 7e92e9e..30e870e 100644 --- a/scripts/checkFacts.mjs +++ b/scripts/checkFacts.mjs @@ -231,8 +231,9 @@ async function main() { 'checkFacts: GITEA_TOKEN is not set.\n\n' + ' Anonymous raw fetches fail on this Gitea instance, and a fact check that skips\n' + ' itself is worse than no fact check — a stale version would ship silently.\n\n' + - ' Locally: GITEA_TOKEN=$(grep -o "[^=]*$" ~/.gitea_token_claude) npm run check:facts\n' + - ' In CI: set GITEA_TOKEN from the repository secret.\n' + ' Locally: GITEA_TOKEN= npm run check:facts\n' + + ' In CI: already wired — .gitea/workflows/pr-checks.yml maps the org-level\n' + + ' REGISTRY_TOKEN secret into GITEA_TOKEN for this step.\n' ); process.exit(2); }