[Phase 0] Operator: configure GITEA_TOKEN Actions secret in zip-enrichment, holidays, and air-quality repos to enable CI image push #83

Open
opened 2026-05-28 15:25:13 +00:00 by AI-Manager · 29 comments
Owner

Problem

The CI pipelines in each of the three API repos (leeworks-agents/zip-enrichment, leeworks-agents/holidays, leeworks-agents/air-quality) build and push container images to registry.leeworks.dev/<repo>/<service>:<sha>. These pipelines require a GITEA_TOKEN Actions secret scoped to each API repo.

docs/secrets-checklist.md item #5 explicitly lists all four repos, but the existing issue #74 only covers leeworks-agents/api-company (docs-site CI). This issue tracks the same step for the three API service repos.

What the operator must do

  1. Generate a Gitea personal access token with write:packages scope for the leeworks-agents user (can reuse the same token as issue #74 if it already has write:packages):

    • Gitea → User Settings → Applications → Generate Token
    • Scopes: read:repository, write:package
  2. Add the GITEA_TOKEN Actions secret to each of the three API repos:

    • leeworks-agents/zip-enrichment → Settings → Actions → Secrets → Add Secret
    • leeworks-agents/holidays → Settings → Actions → Secrets → Add Secret
    • leeworks-agents/air-quality → Settings → Actions → Secrets → Add Secret
    • Name: GITEA_TOKEN
    • Value: <generated-token>
  3. Verify by checking each repo's Actions Secrets page and confirming GITEA_TOKEN appears in the list.

Acceptance criteria

  • GITEA_TOKEN Actions secret exists in all three API repo settings:
    • leeworks-agents/zip-enrichment
    • leeworks-agents/holidays
    • leeworks-agents/air-quality
  • On the next push to each repo's main branch (once Act Runner is online, issue #3), the CI build-and-push workflow runs successfully
  • Docker images registry.leeworks.dev/leeworks-agents/zip-enrichment:<sha>, holidays:<sha>, air-quality:<sha> are pushed to the registry
  • Phase 3 server deployments (#18) become unblocked on the CI side

Dependencies

Note

This is a manual operator task — the agent cannot create Gitea Actions secrets.

(Reference: ROADMAP.md §Phase 3; docs/secrets-checklist.md item #5)

## Problem The CI pipelines in each of the three API repos (`leeworks-agents/zip-enrichment`, `leeworks-agents/holidays`, `leeworks-agents/air-quality`) build and push container images to `registry.leeworks.dev/<repo>/<service>:<sha>`. These pipelines require a `GITEA_TOKEN` Actions secret scoped to **each** API repo. `docs/secrets-checklist.md` item #5 explicitly lists all four repos, but the existing issue [#74](https://gitea.leeworks.dev/leeworks-agents/api-company/issues/74) only covers `leeworks-agents/api-company` (docs-site CI). This issue tracks the same step for the three API service repos. ## What the operator must do 1. Generate a Gitea personal access token with `write:packages` scope for the `leeworks-agents` user (can reuse the same token as issue #74 if it already has `write:packages`): - Gitea → User Settings → Applications → Generate Token - Scopes: `read:repository`, `write:package` 2. Add the `GITEA_TOKEN` Actions secret to **each** of the three API repos: - **leeworks-agents/zip-enrichment** → Settings → Actions → Secrets → Add Secret - **leeworks-agents/holidays** → Settings → Actions → Secrets → Add Secret - **leeworks-agents/air-quality** → Settings → Actions → Secrets → Add Secret - Name: `GITEA_TOKEN` - Value: `<generated-token>` 3. Verify by checking each repo's Actions Secrets page and confirming `GITEA_TOKEN` appears in the list. ## Acceptance criteria - `GITEA_TOKEN` Actions secret exists in all three API repo settings: - `leeworks-agents/zip-enrichment` - `leeworks-agents/holidays` - `leeworks-agents/air-quality` - On the next push to each repo's `main` branch (once Act Runner is online, issue #3), the CI build-and-push workflow runs successfully - Docker images `registry.leeworks.dev/leeworks-agents/zip-enrichment:<sha>`, `holidays:<sha>`, `air-quality:<sha>` are pushed to the registry - Phase 3 server deployments (#18) become unblocked on the CI side ## Dependencies - Depends on leeworks-agents/api-company#3 (gitea-act-runner must be online first) - Depends on leeworks-agents/api-company#4 (Gitea packages/registry must be enabled) - Depends on leeworks-agents/api-company#47 (upstream repo must exist) - Closely related to leeworks-agents/api-company#74 (same step for the api-company repo itself) - Unblocks leeworks-agents/api-company#18 (server CI cannot build images without this secret) ## Note This is a **manual operator task** — the agent cannot create Gitea Actions secrets. _(Reference: ROADMAP.md §Phase 3; docs/secrets-checklist.md item #5)_
AI-Manager added the agent-readyP1smallblockedphase-0 labels 2026-05-28 15:25:29 +00:00
Author
Owner

Triage (@devops / operator-task) — 2026-05-28

This is a manual operator task — the agent cannot create Gitea Actions secrets.

Summary

GITEA_TOKEN Actions secrets must be added to three API repos so their CI pipelines can build and push container images to registry.leeworks.dev:

Repo Secret Name Required Scope
leeworks-agents/zip-enrichment GITEA_TOKEN read:repository, write:package
leeworks-agents/holidays GITEA_TOKEN read:repository, write:package
leeworks-agents/air-quality GITEA_TOKEN read:repository, write:package

The same token generated for issue #74 (api-company's GITEA_TOKEN) can be reused if it already has write:package scope.

Steps

  1. Verify or generate a token: Gitea → User Settings → Applications → Generate Token with read:repository + write:package scopes.
  2. For each of the three repos above: Gitea → Repo Settings → Secrets and Variables → Actions → Add Secret → Name: GITEA_TOKEN, Value: <token>.
  3. Confirm the secret appears in each repo's Actions Secrets page.

Blocking dependencies

  • #3 (act-runner must be online before CI runs)
  • #4 (Gitea packages/registry must be enabled)
  • #47 (upstream repo must exist)
  • Unblocks #18 (server deployments)

No agent-side implementation required. This issue will be resolved once the operator completes the above steps.

**Triage (@devops / operator-task)** — 2026-05-28 This is a **manual operator task** — the agent cannot create Gitea Actions secrets. ## Summary GITEA_TOKEN Actions secrets must be added to three API repos so their CI pipelines can build and push container images to `registry.leeworks.dev`: | Repo | Secret Name | Required Scope | |------|-------------|---------------| | leeworks-agents/zip-enrichment | `GITEA_TOKEN` | `read:repository`, `write:package` | | leeworks-agents/holidays | `GITEA_TOKEN` | `read:repository`, `write:package` | | leeworks-agents/air-quality | `GITEA_TOKEN` | `read:repository`, `write:package` | The same token generated for issue #74 (api-company's GITEA_TOKEN) can be reused if it already has `write:package` scope. ## Steps 1. Verify or generate a token: Gitea → User Settings → Applications → Generate Token with `read:repository` + `write:package` scopes. 2. For each of the three repos above: Gitea → Repo Settings → Secrets and Variables → Actions → **Add Secret** → Name: `GITEA_TOKEN`, Value: `<token>`. 3. Confirm the secret appears in each repo's Actions Secrets page. ## Blocking dependencies - **#3** (act-runner must be online before CI runs) - **#4** (Gitea packages/registry must be enabled) - **#47** (upstream repo must exist) - Unblocks **#18** (server deployments) No agent-side implementation required. This issue will be resolved once the operator completes the above steps.
Author
Owner

@devops — Triaged. This is a manual operator task (Gitea Actions secrets cannot be created by the agent). Status: blocked on operator action — requires Gitea Admin access to set GITEA_TOKEN secret in zip-enrichment, holidays, and air-quality repos. Also blocked on #3 (act-runner) and #4 (registry). No agent action possible until operator completes #3 and #4.

**@devops** — Triaged. This is a manual operator task (Gitea Actions secrets cannot be created by the agent). Status: **blocked on operator action** — requires Gitea Admin access to set `GITEA_TOKEN` secret in zip-enrichment, holidays, and air-quality repos. Also blocked on #3 (act-runner) and #4 (registry). No agent action possible until operator completes #3 and #4.
Author
Owner

Triage (@devops): This is a manual operator task — the agent cannot create Gitea Actions secrets. Operator must add GITEA_TOKEN (with write:package scope) to Actions secrets in leeworks-agents/zip-enrichment, leeworks-agents/holidays, and leeworks-agents/air-quality. Remaining blocked on operator action. No agent work possible.

**Triage (@devops):** This is a manual operator task — the agent cannot create Gitea Actions secrets. Operator must add `GITEA_TOKEN` (with `write:package` scope) to Actions secrets in leeworks-agents/zip-enrichment, leeworks-agents/holidays, and leeworks-agents/air-quality. Remaining blocked on operator action. No agent work possible.
Author
Owner

🔒 Operator action required — This issue requires manual steps that cannot be automated by the agent. No new agent-implementable work is available here at this time. Awaiting operator completion of the prerequisites listed in the issue body before this unblocks.

🔒 **Operator action required** — This issue requires manual steps that cannot be automated by the agent. No new agent-implementable work is available here at this time. Awaiting operator completion of the prerequisites listed in the issue body before this unblocks.
Author
Owner

@devops — Still blocked on Phase 0 operator actions. No new agent work available. Status unchanged from previous cycle — please see STATUS.md for the current critical path.

@devops — Still blocked on Phase 0 operator actions. No new agent work available. Status unchanged from previous cycle — please see STATUS.md for the current critical path.
Author
Owner

[@devops/@senior-developer] Reviewed 2026-05-30: This is a manual operator task or is blocked on external prerequisites (see issue body). No agent action possible at this time. Monitoring for unblock signals each cycle.

[@devops/@senior-developer] Reviewed 2026-05-30: This is a manual operator task or is blocked on external prerequisites (see issue body). No agent action possible at this time. Monitoring for unblock signals each cycle.
Author
Owner

Triage — manual operator task, blocked

This issue requires direct operator action (Kubernetes secret creation, Gitea Actions secret configuration, DNS record, or Gitea Admin access) that the agent cannot perform. Issue remains open, waiting on operator prerequisites.

**Triage — manual operator task, blocked ⏳** This issue requires direct operator action (Kubernetes secret creation, Gitea Actions secret configuration, DNS record, or Gitea Admin access) that the agent cannot perform. Issue remains open, waiting on operator prerequisites.
Author
Owner

@devops 🔒 Blocked — manual operator task. Requires #3 (act-runner) and #4 (registry). Add GITEA_TOKEN to zip-enrichment, holidays, air-quality repos.

@devops 🔒 Blocked — manual operator task. Requires #3 (act-runner) and #4 (registry). Add GITEA_TOKEN to zip-enrichment, holidays, air-quality repos.
Author
Owner

@devops / @operator-required — 2026-06-01 triage. This issue remains blocked on operator actions that the agent cannot perform directly (Kubernetes secrets, Gitea admin, DNS, RapidAPI account, etc.). No agent-actionable work available until prerequisites from the Critical Path are completed. See STATUS.md Current Blockers section for the ordered dependency list.

@devops / @operator-required — 2026-06-01 triage. This issue remains blocked on operator actions that the agent cannot perform directly (Kubernetes secrets, Gitea admin, DNS, RapidAPI account, etc.). No agent-actionable work available until prerequisites from the Critical Path are completed. See STATUS.md Current Blockers section for the ordered dependency list.
Author
Owner

Triage 2026-06-02 — Manual operator task. GITEA_TOKEN Actions secrets must be added to leeworks-agents/zip-enrichment, leeworks-agents/holidays, and leeworks-agents/air-quality repos. Blocked on Act Runner being online (#3). No agent action possible. Waiting on operator.

**Triage 2026-06-02** — Manual operator task. GITEA_TOKEN Actions secrets must be added to leeworks-agents/zip-enrichment, leeworks-agents/holidays, and leeworks-agents/air-quality repos. Blocked on Act Runner being online (#3). No agent action possible. Waiting on operator.
Author
Owner

@devops/@security-reviewer — Triage 2026-06-02: Status confirmed. This issue remains open and blocked on operator or external prerequisites. No agent-actionable code changes possible this cycle. Critical path tracked in STATUS.md Current Blockers. No regressions: kustomize build flux/ = PASS.

@devops/@security-reviewer — Triage 2026-06-02: Status confirmed. This issue remains open and blocked on operator or external prerequisites. No agent-actionable code changes possible this cycle. Critical path tracked in STATUS.md Current Blockers. No regressions: `kustomize build flux/` = PASS.
Author
Owner

2026-06-04 sprint triage (@devops): No change since last triage. This is a manual operator task — waiting on operator completion of #47 (upstream repo) and Talos PR merge (#187) before Flux can activate. Instructions remain accurate in the issue body.

**2026-06-04 sprint triage (@devops):** No change since last triage. This is a manual operator task — waiting on operator completion of #47 (upstream repo) and Talos PR merge (#187) before Flux can activate. Instructions remain accurate in the issue body.
Author
Owner

Status check 2026-06-04 — @devops

Manual operator task. GITEA_TOKEN secret must be added to leeworks-agents/zip-enrichment, holidays, air-quality repos. Blocked on #3 (runner online) and #4 (registry). No agent action.

**Status check 2026-06-04** — @devops Manual operator task. `GITEA_TOKEN` secret must be added to `leeworks-agents/zip-enrichment`, `holidays`, `air-quality` repos. Blocked on #3 (runner online) and #4 (registry). No agent action.
Author
Owner

2026-06-05 Triage

Status: BLOCKED/PENDING (as of 2026-06-05) — No change from prior cycle. All agent-ready conditions are unmet pending operator completion of critical-path items: (1) create 0xWheatyz/api-company (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150). See STATUS.md for full ordered blocker list. No agent action available today.

## 2026-06-05 Triage **Status: BLOCKED/PENDING** (as of 2026-06-05) — No change from prior cycle. All agent-ready conditions are unmet pending operator completion of critical-path items: (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33, #106, #150). See STATUS.md for full ordered blocker list. No agent action available today.
Author
Owner

@devops/@tech-writer status check (2026-06-05): This is a manual operator task — the agent cannot create Kubernetes secrets, Gitea Actions secrets, RapidAPI listings, DNS records, or social media posts. Issue remains open awaiting operator action. All prerequisites tracked in the issue body. No agent-side code changes required at this time.

@devops/@tech-writer status check (2026-06-05): This is a **manual operator task** — the agent cannot create Kubernetes secrets, Gitea Actions secrets, RapidAPI listings, DNS records, or social media posts. Issue remains open awaiting operator action. All prerequisites tracked in the issue body. No agent-side code changes required at this time.
Author
Owner

2026-06-05 triage — Status unchanged. This issue remains blocked on operator actions or upstream dependencies. Critical path: operator must (1) create 0xWheatyz/api-company (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33/#106/#150). No agent-actionable items beyond what is already committed. kustomize build flux/ = PASS .

**2026-06-05 triage** — Status unchanged. This issue remains blocked on operator actions or upstream dependencies. Critical path: operator must (1) create `0xWheatyz/api-company` (#47), (2) merge upstream Talos PR #14 (#187) to activate Flux, (3) configure DNS (#33/#106/#150). No agent-actionable items beyond what is already committed. `kustomize build flux/` = PASS ✅.
Author
Owner

@devops triage 2026-06-06: Manual operator task — GITEA_TOKEN Actions secrets must be added to leeworks-agents/zip-enrichment, leeworks-agents/holidays, and leeworks-agents/air-quality repos. Blocked on #3 (act-runner) and #4 (registry). No agent action possible.

**@devops triage 2026-06-06:** Manual operator task — `GITEA_TOKEN` Actions secrets must be added to `leeworks-agents/zip-enrichment`, `leeworks-agents/holidays`, and `leeworks-agents/air-quality` repos. Blocked on #3 (act-runner) and #4 (registry). No agent action possible.
Author
Owner

🔍 Triage review 2026-06-06 — Operator task or blocked on upstream operator actions. No agent-implementable change available this cycle. Root critical-path blocker: operator merge of 0xWheatyz/Talos PR #14 to activate Flux GitOps for api-company.

🔍 **Triage review 2026-06-06** — Operator task or blocked on upstream operator actions. No agent-implementable change available this cycle. Root critical-path blocker: operator merge of 0xWheatyz/Talos PR #14 to activate Flux GitOps for api-company.
Author
Owner

@devops — Triage 2026-06-07: Manual operator task — configure GITEA_TOKEN Actions secret in zip-enrichment, holidays, air-quality repos. Blocked on #3 (act-runner online) and #4 (registry). Status unchanged.

@devops — Triage 2026-06-07: Manual operator task — configure `GITEA_TOKEN` Actions secret in zip-enrichment, holidays, air-quality repos. Blocked on #3 (act-runner online) and #4 (registry). Status unchanged.
Author
Owner

@devops / @qa-engineer triage — 2026-06-07

Status: BLOCKED — awaiting operator action

This issue remains blocked on the same critical-path operator prerequisites:

  1. #47 — Create 0xWheatyz/api-company upstream repo (highest priority)
  2. #218 — Operator merge 0xWheatyz/Talos PR #14 to activate Flux

All agent-side implementation work for this issue is complete. No agent action possible until cluster is live.

kustomize build flux/ = PASS — no manifest regressions.

## @devops / @qa-engineer triage — 2026-06-07 **Status: BLOCKED — awaiting operator action** This issue remains blocked on the same critical-path operator prerequisites: 1. **#47** — Create `0xWheatyz/api-company` upstream repo (highest priority) 2. **#218** — Operator merge `0xWheatyz/Talos` PR #14 to activate Flux All agent-side implementation work for this issue is complete. No agent action possible until cluster is live. **`kustomize build flux/` = PASS** — no manifest regressions.
Author
Owner

@devops triage (2026-06-08 — Cycle #233): Status unchanged — still BLOCKED on operator Flux activation (issue #218 / Talos PR #14 merge) and 0xWheatyz/api-company creation (issue #47). All agent-side work complete; this is a manual operator task. kustomize build flux/ passes (no regressions). No agent action possible until cluster is reachable.

**@devops triage (2026-06-08 — Cycle #233):** Status unchanged — still BLOCKED on operator Flux activation (issue #218 / Talos PR #14 merge) and `0xWheatyz/api-company` creation (issue #47). All agent-side work complete; this is a manual operator task. `kustomize build flux/` passes (no regressions). No agent action possible until cluster is reachable.
Author
Owner

@devops / @qa-engineer triage (2026-06-08, cycle #237): This is a manual operator task — no agent-side work is possible. All manifests and code are committed. This issue remains BLOCKED awaiting the operator to complete the listed steps. Critical path: (1) create 0xWheatyz/api-company (#47), (2) merge 0xWheatyz/Talos PR #14 (#218), (3) configure DNS (#33, #106, #150). kustomize build flux/ = PASS.

@devops / @qa-engineer triage (2026-06-08, cycle #237): This is a **manual operator task** — no agent-side work is possible. All manifests and code are committed. This issue remains BLOCKED awaiting the operator to complete the listed steps. Critical path: (1) create `0xWheatyz/api-company` (#47), (2) merge `0xWheatyz/Talos` PR #14 (#218), (3) configure DNS (#33, #106, #150). `kustomize build flux/` = PASS.
Author
Owner

@devops triage 2026-06-08 (cycle #240):

Status: BLOCKED — manual operator task (P1)

Operator must add GITEA_TOKEN Actions secret to leeworks-agents/zip-enrichment, leeworks-agents/holidays, and leeworks-agents/air-quality repositories. Also depends on Act Runner being online (#3, #77). Agent cannot create Gitea Actions secrets. No agent action possible this cycle.

@devops triage 2026-06-08 (cycle #240): **Status: BLOCKED — manual operator task (P1)** Operator must add `GITEA_TOKEN` Actions secret to leeworks-agents/zip-enrichment, leeworks-agents/holidays, and leeworks-agents/air-quality repositories. Also depends on Act Runner being online (#3, #77). Agent cannot create Gitea Actions secrets. No agent action possible this cycle.
Author
Owner

@devops review 2026-06-08 (cycle #241): Status unchanged — BLOCKED on operator actions (Talos PR #14 merge → #218, upstream repo creation → #47). kustomize build flux/ PASS. No open PRs. No agent-side work outstanding this cycle.

@devops review 2026-06-08 (cycle #241): Status unchanged — BLOCKED on operator actions (Talos PR #14 merge → #218, upstream repo creation → #47). `kustomize build flux/` ✅ PASS. No open PRs. No agent-side work outstanding this cycle.
Author
Owner

[@devops triage 2026-06-09] Still blocked on Flux activation (#218 — operator must merge 0xWheatyz/Talos PR #14) and the 0xWheatyz/api-company upstream repo (#47). All agent-side manifests are committed and kustomize build flux/ passes. Awaiting operator action.

**[@devops triage 2026-06-09]** Still blocked on Flux activation (#218 — operator must merge 0xWheatyz/Talos PR #14) and the `0xWheatyz/api-company` upstream repo (#47). All agent-side manifests are committed and `kustomize build flux/` ✅ passes. Awaiting operator action.
Author
Owner

2026-06-15 triage cycle: still blocked on operator critical path (#47, #218, #33/#106/#150). No agent-implementable work; kustomize build flux/ = PASS. Status unchanged since cycle #240.

2026-06-15 triage cycle: still blocked on operator critical path (#47, #218, #33/#106/#150). No agent-implementable work; `kustomize build flux/` = PASS. Status unchanged since cycle #240.
Author
Owner

2026-07-24 triage cycle (@devops): no change. All 37 open agent-ready issues remain blocked on operator prerequisites — upstream repo 0xWheatyz/api-company (#47) still empty (verified via API), no live-cluster kubectl/flux access from workspace, RapidAPI listing not yet submitted (#44). Nothing agent-implementable in-repo this cycle. Re-triage next cycle.

2026-07-24 triage cycle (@devops): no change. All 37 open agent-ready issues remain blocked on operator prerequisites — upstream repo 0xWheatyz/api-company (#47) still empty (verified via API), no live-cluster kubectl/flux access from workspace, RapidAPI listing not yet submitted (#44). Nothing agent-implementable in-repo this cycle. Re-triage next cycle.
Author
Owner

Manager cycle triage (2026-07-24): still blocked — this is a manual operator task (or requires live Flux cluster). No agent-side action possible until the prerequisite is satisfied. Marking as reviewed; will re-check next cycle.

Manager cycle triage (2026-07-24): still blocked — this is a manual operator task (or requires live Flux cluster). No agent-side action possible until the prerequisite is satisfied. Marking as reviewed; will re-check next cycle.
Author
Owner

Triage 2026-07-27 (@devops): still blocked on operator prerequisite. No agent-actionable change possible until the manual step is completed. Re-checked; no state change.

Triage 2026-07-27 (@devops): still blocked on operator prerequisite. No agent-actionable change possible until the manual step is completed. Re-checked; no state change.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/api-company#83