gitea/agents
8
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ops: record minted tokens in the private gitea/secrets inventory

Browse Source 
@ops now treats gitea/secrets/tokens.md as the source-of-truth inventory (readable by @ffaerber and
@ops only) and records every token it mints/rotates there, alongside storing the live value in the
matching Actions secret.
This commit is contained in:
Felix Faerber
2026-07-05 14:09:13 +03:00
parent 74d3e1d229
commit 6832d7ad6c
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/scripts/skill-gitea-admin.sh
+8
View File
@@ -66,6 +66,14 @@ curl -sS -X PUT -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: applica
Token **scopes** are groups of `read:`/`write:` on: `repository`, `issue`, `organization`, `user`, Token **scopes** are groups of `read:`/`write:` on: `repository`, `issue`, `organization`, `user`,
`package`, `notification`, `misc`, and (only for a privileged token) `admin`. `package`, `notification`, `misc`, and (only for a privileged token) `admin`.
## Token inventory — record everything in `gitea/secrets`
The private repo **`gitea/secrets`** (readable only by @ffaerber and @ops) is the source of truth for
tokens. Whenever you mint, rotate, or re-scope a token, append/update a row in its `tokens.md` via the
contents API (`GET` the file for its `sha`, then `PUT` the updated base64 content with that `sha`):
`| <token/secret name> | <owner user> | <scopes> | <Actions secret it is stored in> | <notes> |`.
Storing the live value in the matching Actions secret is what workflows use; the `gitea/secrets` row
is the human-readable inventory. Never paste a token value into any issue/PR/comment/log.
## Change a user's token scope (the "update my token" flow) ## Change a user's token scope (the "update my token" flow)
Tokens are immutable — you can't edit scopes. Re-mint: delete the old token and create a new one, Tokens are immutable — you can't edit scopes. Re-mint: delete the old token and create a new one,
then overwrite the stored secret. then overwrite the stored secret.