fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270) #35

2026-06-05T00:54:24Z

Barcode Betty commented

2026-06-05 00:54:24 +00:00

Summary

Per CAR-1270, the auth deploy-dev and deploy-uat jobs (migrated to the PR-bump pattern in CAR-1263) were still failing at the Checkout infra repo step with Repository not found. Root cause: those jobs authenticated the cross-repo cartsnitch/infra checkout + infra PR API calls with secrets.GITEA_TOKEN (the auto, repo-scoped Actions token), which has no read access to the private cartsnitch/infra repo.

The working sibling cartsnitch/cartsnitch uses secrets.CI_GITEA_TOKEN for these same operations. This PR makes auth match.

Change

In .gitea/workflows/ci.yml, only inside the two deploy jobs:

Infra checkout step: token: ${{ secrets.GITEA_TOKEN }} → token: ${{ secrets.CI_GITEA_TOKEN }}
The Commit and push to infra (via PR) step env: block: GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} → CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
The three -H "Authorization: token ${GITEA_TOKEN}" curl calls → -H "Authorization: token ${CI_GITEA_TOKEN}"

Untouched (by design)

build-and-push job password: ${{ secrets.REGISTRY_TOKEN }} — registry login, correct per CAR-1009
All other build/registry logic
The git push origin "$BRANCH" line in the PR-bump step (the PR-bump pattern itself is correct; only the auth token name changes)

Target branches

Separate PRs for uat and main (dev HEAD does not carry these deploy jobs yet, so not opened for dev).

Co-Authored-By: Paperclip noreply@paperclip.ing

cc @cpfarhood

## Summary Per CAR-1270, the auth `deploy-dev` and `deploy-uat` jobs (migrated to the PR-bump pattern in [CAR-1263](https://git.farh.net/cartsnitch/auth/pulls/33)) were still failing at the **Checkout infra repo** step with `Repository not found`. Root cause: those jobs authenticated the cross-repo `cartsnitch/infra` checkout + infra PR API calls with `secrets.GITEA_TOKEN` (the auto, repo-scoped Actions token), which has no read access to the private `cartsnitch/infra` repo. The working sibling `cartsnitch/cartsnitch` uses `secrets.CI_GITEA_TOKEN` for these same operations. This PR makes auth match. ## Change In `.gitea/workflows/ci.yml`, **only inside the two deploy jobs**: 1. Infra checkout step: `token: ${{ secrets.GITEA_TOKEN }}` → `token: ${{ secrets.CI_GITEA_TOKEN }}` 2. The `Commit and push to infra (via PR)` step `env:` block: `GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}` → `CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}` 3. The three `-H "Authorization: token ${GITEA_TOKEN}"` curl calls → `-H "Authorization: token ${CI_GITEA_TOKEN}"` ## Untouched (by design) - `build-and-push` job `password: ${{ secrets.REGISTRY_TOKEN }}` — registry login, correct per CAR-1009 - All other build/registry logic - The `git push origin "$BRANCH"` line in the PR-bump step (the PR-bump pattern itself is correct; only the auth token name changes) ## Target branches Separate PRs for `uat` and `main` (dev HEAD does not carry these deploy jobs yet, so not opened for dev). Co-Authored-By: Paperclip <noreply@paperclip.ing> cc @cpfarhood

Barcode Betty added 1 commit 2026-06-05 00:54:24 +00:00

fix(ci): use CI_GITEA_TOKEN for cross-repo infra access in deploy jobs (CAR-1270)

CI / build-and-push (pull_request) Has been skipped

Details

CI / deploy-dev (pull_request) Has been skipped

Details

CI / deploy-uat (pull_request) Has been skipped

Details

a0be839632

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Savannah Savings merged commit 72f2568b68 into main

2026-06-05 05:12:45 +00:00

Savannah Savings deleted branch betty/car-1270-ci-gitea-token-main

2026-06-05 05:12:46 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cartsnitch/auth#35