Follow-up to #59. Updates the Required secrets table so the docs match the shipped behavior:
TOKEN_* are now documented as primary — each agent runs with only its own token as SELF_TOKEN and acts as itself (post/commit/comment, @qa merge, gitea-api skill scopes). Notes TOKEN_QA needs write:repository.
Added TOKEN_OPS (the @ops admin token behind gitea-admin).
AGENT_TOKEN reframed as the fallback for repos without per-agent tokens (still needed for the trigger-comment + merge-fires-deploy cases the built-in token can't do).
Clarified the SELF_TOKEN selection and GITEA_TOKEN's read / identity-fallback role.
Docs-only; no workflow behavior change.
Follow-up to #59. Updates the *Required secrets* table so the docs match the shipped behavior:
- `TOKEN_*` are now documented as **primary** — each agent runs with only its own token as `SELF_TOKEN` and acts as itself (post/commit/comment, `@qa` merge, `gitea-api` skill scopes). Notes `TOKEN_QA` needs `write:repository`.
- Added `TOKEN_OPS` (the `@ops` admin token behind `gitea-admin`).
- `AGENT_TOKEN` reframed as the **fallback** for repos without per-agent tokens (still needed for the trigger-comment + merge-fires-deploy cases the built-in token can't do).
- Clarified the `SELF_TOKEN` selection and `GITEA_TOKEN`'s read / identity-fallback role.
Docs-only; no workflow behavior change.
The secret table still described AGENT_TOKEN as primary and TOKEN_* as
optional "falls back to the bot". The per-agent-token refactor inverted that:
each agent's own TOKEN_* is primary (selected into SELF_TOKEN), AGENT_TOKEN is
now only the fallback for repos without per-agent tokens. Document TOKEN_OPS,
the SELF_TOKEN selection, and that TOKEN_QA needs write:repository to merge.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #59. Updates the Required secrets table so the docs match the shipped behavior:
TOKEN_*are now documented as primary — each agent runs with only its own token asSELF_TOKENand acts as itself (post/commit/comment,@qamerge,gitea-apiskill scopes). NotesTOKEN_QAneedswrite:repository.TOKEN_OPS(the@opsadmin token behindgitea-admin).AGENT_TOKENreframed as the fallback for repos without per-agent tokens (still needed for the trigger-comment + merge-fires-deploy cases the built-in token can't do).SELF_TOKENselection andGITEA_TOKEN's read / identity-fallback role.Docs-only; no workflow behavior change.