fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270) #34

2026-06-05T00:54:23Z

Barcode Betty commented

2026-06-05 00:54:23 +00:00

Summary

Per CAR-1270, the auth deploy-dev and deploy-uat jobs (migrated to the PR-bump pattern in CAR-1263) were still failing at the Checkout infra repo step with Repository not found. Root cause: those jobs authenticated the cross-repo cartsnitch/infra checkout + infra PR API calls with secrets.GITEA_TOKEN (the auto, repo-scoped Actions token), which has no read access to the private cartsnitch/infra repo.

The working sibling cartsnitch/cartsnitch uses secrets.CI_GITEA_TOKEN for these same operations. This PR makes auth match.

Change

In .gitea/workflows/ci.yml, only inside the two deploy jobs:

Infra checkout step: token: ${{ secrets.GITEA_TOKEN }} → token: ${{ secrets.CI_GITEA_TOKEN }}
The Commit and push to infra (via PR) step env: block: GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} → CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
The three -H "Authorization: token ${GITEA_TOKEN}" curl calls → -H "Authorization: token ${CI_GITEA_TOKEN}"

Untouched (by design)

build-and-push job password: ${{ secrets.REGISTRY_TOKEN }} — registry login, correct per CAR-1009
All other build/registry logic
The git push origin "$BRANCH" line in the PR-bump step (the PR-bump pattern itself is correct; only the auth token name changes)

Target branches

Separate PRs will be opened for uat and main (dev HEAD does not carry these deploy jobs yet, so not opened for dev).

Co-Authored-By: Paperclip noreply@paperclip.ing

cc @cpfarhood

## Summary Per CAR-1270, the auth `deploy-dev` and `deploy-uat` jobs (migrated to the PR-bump pattern in [CAR-1263](https://git.farh.net/cartsnitch/auth/pulls/32)) were still failing at the **Checkout infra repo** step with `Repository not found`. Root cause: those jobs authenticated the cross-repo `cartsnitch/infra` checkout + infra PR API calls with `secrets.GITEA_TOKEN` (the auto, repo-scoped Actions token), which has no read access to the private `cartsnitch/infra` repo. The working sibling `cartsnitch/cartsnitch` uses `secrets.CI_GITEA_TOKEN` for these same operations. This PR makes auth match. ## Change In `.gitea/workflows/ci.yml`, **only inside the two deploy jobs**: 1. Infra checkout step: `token: ${{ secrets.GITEA_TOKEN }}` → `token: ${{ secrets.CI_GITEA_TOKEN }}` 2. The `Commit and push to infra (via PR)` step `env:` block: `GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}` → `CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}` 3. The three `-H "Authorization: token ${GITEA_TOKEN}"` curl calls → `-H "Authorization: token ${CI_GITEA_TOKEN}"` ## Untouched (by design) - `build-and-push` job `password: ${{ secrets.REGISTRY_TOKEN }}` — registry login, correct per CAR-1009 - All other build/registry logic - The `git push origin "$BRANCH"` line in the PR-bump step (the PR-bump pattern itself is correct; only the auth token name changes) ## Target branches Separate PRs will be opened for `uat` and `main` (dev HEAD does not carry these deploy jobs yet, so not opened for dev). Co-Authored-By: Paperclip <noreply@paperclip.ing> cc @cpfarhood

Barcode Betty added 1 commit 2026-06-05 00:54:24 +00:00

fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270)

CI / build-and-push (pull_request) Has been skipped

Details

CI / deploy-dev (pull_request) Has been skipped

Details

CI / deploy-uat (pull_request) Has been skipped

Details

d5c5d2b6ba

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Savannah Savings merged commit 8a49fc57f1 into uat

2026-06-05 05:12:38 +00:00

Savannah Savings deleted branch betty/car-1270-ci-gitea-token-uat

2026-06-05 05:12:38 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cartsnitch/auth#34