fix(ci): repair failing Gitea Actions (validate-flux + build-docs) #243

2026-06-20T21:26:50Z

0xWheatyz commented

2026-06-20 21:26:50 +00:00

Why

Both repo workflows were failing on every run (confirmed via tea actions runs view; the list view hides conclusions and shows everything as completed).

validate-flux.yaml — sudo: command not found (exit 127)

The Gitea act runner runs as root and has no sudo. Changed 'sudo mv kustomize /usr/local/bin/' to install directly.

build-docs.yaml — cross-repo checkout failed (default branch not found)

The sibling-repo checkouts used the auto-injected GITEA_TOKEN, which is scoped to this repo only and can't read the API repos. GITEA_TOKEN is also a reserved secret name that can't be overridden, so the checkouts now use a new SIBLING_REPOS_TOKEN secret (a read-only PAT, already configured).

Also added (not CI)

docs/deploy-apis-flux-talos.md — Flux/Talos deploy guide.
scripts/setup-sibling-repos-token.sh — helper that mints the PAT and stores it as the action secret.

Test plan

Merging triggers build-docs (push to main); validate-flux runs on this PR.
Expect both green; verify with tea actions runs view .

## Why Both repo workflows were failing on every run (confirmed via tea actions runs view; the list view hides conclusions and shows everything as completed). ### validate-flux.yaml — sudo: command not found (exit 127) The Gitea act runner runs as root and has no sudo. Changed 'sudo mv kustomize /usr/local/bin/' to install directly. ### build-docs.yaml — cross-repo checkout failed (default branch not found) The sibling-repo checkouts used the auto-injected GITEA_TOKEN, which is scoped to this repo only and can't read the API repos. GITEA_TOKEN is also a reserved secret name that can't be overridden, so the checkouts now use a new SIBLING_REPOS_TOKEN secret (a read-only PAT, already configured). ## Also added (not CI) - docs/deploy-apis-flux-talos.md — Flux/Talos deploy guide. - scripts/setup-sibling-repos-token.sh — helper that mints the PAT and stores it as the action secret. ## Test plan - Merging triggers build-docs (push to main); validate-flux runs on this PR. - Expect both green; verify with tea actions runs view <id>.

0xWheatyz added 2 commits 2026-06-20 21:26:50 +00:00

fix(ci): repair failing Gitea Actions ff7c9cfb7e

docs(deploy): add Flux/Talos deploy guide + sibling-repos PAT helper script

Validate Flux manifests / kustomize-build (pull_request) Failing after 26s

Details

1949873757

0xWheatyz added 1 commit 2026-06-20 21:29:41 +00:00

fix(ci): install kustomize via pinned release tarball with retries

Validate Flux manifests / kustomize-build (pull_request) Successful in 22s

Details

58e7a8e319

0xWheatyz added 1 commit 2026-06-20 21:32:02 +00:00

build(docs-site): add package-lock.json so 'npm ci' works in CI

Validate Flux manifests / kustomize-build (pull_request) Successful in 21s

Details

d3f7222db1

0xWheatyz added 1 commit 2026-06-20 21:36:05 +00:00

fix(docs-site): pin @astrojs/sitemap to ~3.2.1 for Astro 4 compat

Validate Flux manifests / kustomize-build (pull_request) Successful in 21s

Details

a374419400

sitemap 3.7.3 reads opts.routes from astro:build:done, which only exists in
Astro 5; on Astro 4.16 it is undefined and crashes the build with
'Cannot read properties of undefined (reading reduce)'. Pin to the 3.2.x line
and lock it so the docs-site build completes.

0xWheatyz added 1 commit 2026-06-20 21:43:53 +00:00

fix(ci): install docker CLI in build-docs before registry steps

Validate Flux manifests / kustomize-build (pull_request) Successful in 22s

Details

3f648cd5a0

0xWheatyz added 1 commit 2026-06-20 21:49:55 +00:00

fix(ci): push docs-site image to gitea.leeworks.dev registry

Validate Flux manifests / kustomize-build (pull_request) Successful in 25s

Details

3cb8f648a1

registry.leeworks.dev serves Traefik's default self-signed cert (TLS verify
fails). Gitea's built-in container registry at gitea.leeworks.dev has a valid
Let's Encrypt cert, so push there instead.

0xWheatyz added 1 commit 2026-06-20 22:01:14 +00:00

fix(ci): authenticate registry push with package-scoped REGISTRY_TOKEN

Validate Flux manifests / kustomize-build (pull_request) Successful in 22s

Details

98807884b1

The auto GITEA_TOKEN has no package-registry scope, so docker login to
gitea.leeworks.dev returned 'unauthorized'. Use a dedicated PAT (REGISTRY_TOKEN,
write:package) with the token-owner username. Helper script now mints both
SIBLING_REPOS_TOKEN and REGISTRY_TOKEN from one password prompt.

0xWheatyz added 1 commit 2026-06-20 22:05:27 +00:00

fix(scripts): unique PAT names + show HTTP error body in token helper

Validate Flux manifests / kustomize-build (pull_request) Successful in 21s

Details

f841c2216b

Re-running the helper hit Gitea 400 'token name has been used' because the
token name was only date-stamped. Add time+pid to make names unique, surface
the real HTTP status/body, and continue past a single token failure.

0xWheatyz merged commit 7d2a8681ab into main

2026-06-20 22:12:00 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: leeworks-agents/api-company#243