0xWheatyz
98807884b1
Validate Flux manifests / kustomize-build (pull_request) Successful in 22s
The auto GITEA_TOKEN has no package-registry scope, so docker login to gitea.leeworks.dev returned 'unauthorized'. Use a dedicated PAT (REGISTRY_TOKEN, write:package) with the token-owner username. Helper script now mints both SIBLING_REPOS_TOKEN and REGISTRY_TOKEN from one password prompt.
58 lines
2.6 KiB
Bash
Executable File
58 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Create the Gitea PATs the build-docs workflow needs and store them as action
|
|
# secrets on leeworks-agents/api-company:
|
|
# - SIBLING_REPOS_TOKEN : read:repository (clone the sibling API repos)
|
|
# - REGISTRY_TOKEN : write:package + read:package
|
|
# (push the docs-site image to gitea.leeworks.dev)
|
|
#
|
|
# Why this script exists:
|
|
# - The auto-injected GITEA_TOKEN is scoped to THIS repo only (can't read
|
|
# sibling repos) and has no package-registry scope (can't push images).
|
|
# GITEA_TOKEN is also a reserved secret name that cannot be overridden.
|
|
# - `tea` cannot CREATE a PAT (no such command), and Gitea's token-creation
|
|
# API requires BASIC AUTH (your password) — a token cannot mint a token.
|
|
# - `tea` CAN set the action secrets using its existing login.
|
|
#
|
|
# So: this prompts for your password ONCE, mints both PATs via the API, and
|
|
# pipes each straight into `tea`. Token values are never written to disk.
|
|
#
|
|
# Usage: bash scripts/setup-sibling-repos-token.sh
|
|
set -euo pipefail
|
|
|
|
GITEA_URL="https://gitea.leeworks.dev"
|
|
GITEA_USER="0xWheatyz"
|
|
REPO="leeworks-agents/api-company"
|
|
STAMP="$(date +%Y%m%d)"
|
|
|
|
command -v curl >/dev/null || { echo "curl required"; exit 1; }
|
|
command -v tea >/dev/null || { echo "tea required"; exit 1; }
|
|
command -v python3 >/dev/null || { echo "python3 required"; exit 1; }
|
|
|
|
echo "Gitea user: $GITEA_USER ($GITEA_URL)"
|
|
read -r -s -p "Gitea password (for $GITEA_USER): " GITEA_PASS
|
|
echo
|
|
|
|
# mint_token <token-name> <json-scopes-array> <secret-name>
|
|
mint_token() {
|
|
local token_name="$1" scopes="$2" secret_name="$3" resp pat
|
|
resp="$(curl -fsS -X POST \
|
|
-u "${GITEA_USER}:${GITEA_PASS}" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"name\":\"${token_name}\",\"scopes\":${scopes}}" \
|
|
"${GITEA_URL}/api/v1/users/${GITEA_USER}/tokens")" || {
|
|
echo "Token '${token_name}' creation failed. Check password / 2FA (2FA blocks basic-auth token creation)." >&2
|
|
return 1
|
|
}
|
|
pat="$(printf '%s' "$resp" | python3 -c 'import sys,json; print(json.load(sys.stdin)["sha1"])')"
|
|
[ -n "$pat" ] || { echo "Could not parse token from: $resp" >&2; return 1; }
|
|
printf '%s' "$pat" | tea actions secrets create "$secret_name" --repo "$REPO" --stdin
|
|
echo " ✓ ${secret_name} set (PAT '${token_name}')"
|
|
}
|
|
|
|
mint_token "sibling-repos-readonly-${STAMP}" '["read:repository"]' "SIBLING_REPOS_TOKEN"
|
|
mint_token "docs-registry-${STAMP}" '["write:package","read:package"]' "REGISTRY_TOKEN"
|
|
|
|
unset GITEA_PASS
|
|
echo "Done. Verify: tea actions secrets list --repo ${REPO}"
|
|
echo "Then re-run build-docs (push to main, or: tea actions workflows dispatch build-docs.yaml)"
|