gitea/agents
8
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

@senior: issue #17 — live agent capability table via Gitea 1.27 /api/v1/token

Browse Source 
skill-gitea-api.sh now introspects each agent's own PAT (AGENT_TOKEN +
TOKEN_PM/SENIOR/JUNIOR/LEAD/QA) via GET /api/v1/token — a Gitea 1.27+
self-introspection endpoint (token-in, scopes-out, no password) — and bakes a
live, always-accurate 'who can do what' matrix into SKILL.md. Every agent that
loads gitea-api sees every teammate's real scopes; no hand-maintained table to
drift when scopes rotate. Falls back to a static note on <1.27 or unset tokens.

agent.yml passes GITHUB_SERVER_URL + the per-agent TOKEN_* secrets into the
gitea-api skill step so the script can introspect them. run-agent.sh adds a
roster note pointing agents to the matrix for capability-based routing.

Least-privilege gating (plan point #3) was already done in issue #22 via
agents.json skills arrays + install-opencode.sh permission.skill scoping, so
no redundant case gates are added here.
This commit is contained in:
senior
2026-07-04 10:10:38 +00:00
parent 1d248bc675
commit a885142e30
3 changed files with 136 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/agent.yml
+13
View File
@@ -126,9 +126,22 @@ jobs:
# maintainer set at creation time — issue/repository/organization/misc read+write, cross-repo).
# Only emitted when AGENT_TOKEN is actually present, so repos without it don't get a
# broken skill. The token is passed via env and never inlined into shell.
#
# Live Agent Capability Table (Gitea 1.27+): the per-agent TOKEN_* secrets are also
# passed here so skill-gitea-api.sh can call GET /api/v1/token (a self-introspection
# endpoint — token-in, scopes-out, no password needed) for every teammate and bake a
# live, always-accurate "who can do what" matrix into the skill. Every agent that loads
# gitea-api then sees every teammate's real scopes, with zero manual upkeep. Tokens not
# set for a repo (or a <1.27 instance with no /token endpoint) are skipped silently.
env:
SCRIPTS: ${{ runner.temp }}/agents-scripts
GITHUB_SERVER_URL: ${{ github.server_url }}
AGENT_TOKEN: ${{ secrets.AGENT_TOKEN }}
TOKEN_PM: ${{ secrets.TOKEN_PM }}
TOKEN_SENIOR: ${{ secrets.TOKEN_SENIOR }}
TOKEN_JUNIOR: ${{ secrets.TOKEN_JUNIOR }}
TOKEN_LEAD: ${{ secrets.TOKEN_LEAD }}
TOKEN_QA: ${{ secrets.TOKEN_QA }}
run: bash "$SCRIPTS/skill-gitea-api.sh"
- name: Inspect / fetch image attachments (download only for vision agents)