pc-heini/HeiniRemote-AgentFlatpak
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 13 Wiki Activity

ci: split tokens — GITHUB_TOKEN for own repo, read-only PAT for upstream
Build and Publish HeiniRemote Agent Flatpak / build (push) Failing after 4m31s
Details

Browse Source 
The package-scoped REGISTRY_TOKEN cannot clone repos (403). Own-repo
operations (checkout, pages push, tag, release) now use the auto-provided
GITHUB_TOKEN; the private upstream clone uses the new read-only secret
HeiniRemoteFlatpakActionReleases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
pc-heiniandClaude Fable 5 committed 2026-07-07 13:19:20 +02:00
1 parent fa40edb680
commit 95060ddf95
1 file changed
+9 -10
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build-flatpak.yml
+9 -10
View File
@@ -51,14 +51,13 @@ jobs:
# Plain git clone instead of actions/checkout@v4: the bare ubuntu image # Plain git clone instead of actions/checkout@v4: the bare ubuntu image
# has no Node.js, so JavaScript actions fail with exit 127. # has no Node.js, so JavaScript actions fail with exit 127.
# #
# REGISTRY_TOKEN is the user-wide write PAT the other repos' actions # Token split: the auto-provided GITHUB_TOKEN covers everything in THIS
# already use. It is required (not just preferred): the auto-provided # repo (checkout, pages push, tag, release). HeiniRemoteFlatpakActionReleases
# GITHUB_TOKEN is scoped to THIS repo only, so it cannot clone the # — a read-only PAT (repository: read) — is only needed where the private
# private upstream HeiniRemote. The GITHUB_TOKEN fallback exists just so # upstream HeiniRemote is cloned, which GITHUB_TOKEN cannot reach.
# the own-repo steps still work if the secret is ever unset.
- name: Checkout - name: Checkout
env: env:
TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }} TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: | run: |
AUTH_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/${GITHUB_REPOSITORY}.git" AUTH_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/${GITHUB_REPOSITORY}.git"
git init -q git init -q
@@ -70,7 +69,7 @@ jobs:
- name: Resolve upstream HeiniRemote version - name: Resolve upstream HeiniRemote version
id: ver id: ver
env: env:
TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }} TOKEN: ${{ secrets.HeiniRemoteFlatpakActionReleases }}
run: | run: |
chmod +x scripts/*.sh chmod +x scripts/*.sh
export UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git" export UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git"
@@ -106,7 +105,7 @@ jobs:
- name: Build agent from upstream source - name: Build agent from upstream source
if: steps.check.outputs.build == 'true' if: steps.check.outputs.build == 'true'
env: env:
TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }} TOKEN: ${{ secrets.HeiniRemoteFlatpakActionReleases }}
run: | run: |
UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git" UPSTREAM_URL="$(echo "${GITHUB_SERVER_URL}" | sed "s#://#://${GITHUB_ACTOR}:${TOKEN}@#")/pc-heini/HeiniRemote.git"
# init+fetch instead of clone: works for tags and bare commit shas alike. # init+fetch instead of clone: works for tags and bare commit shas alike.
@@ -157,7 +156,7 @@ jobs:
- name: Publish OSTree repo to the 'pages' branch - name: Publish OSTree repo to the 'pages' branch
if: steps.check.outputs.build == 'true' if: steps.check.outputs.build == 'true'
env: env:
TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }} TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: | run: |
AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git" AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git"
rm -rf publish && mkdir publish && cd publish rm -rf publish && mkdir publish && cd publish
@@ -175,7 +174,7 @@ jobs:
- name: Tag and release the published version - name: Tag and release the published version
if: steps.check.outputs.build == 'true' if: steps.check.outputs.build == 'true'
env: env:
TOKEN: ${{ secrets.REGISTRY_TOKEN != '' && secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }} TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }} GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
run: | run: |
AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git" AUTH_URL="$(echo "${{ github.server_url }}" | sed "s#://#://${{ github.actor }}:${TOKEN}@#")/${{ github.repository }}.git"