agents: remove shared AGENT_TOKEN — per-agent tokens only #63

2026-07-05T15:51:23+02:00

ffaerber commented

2026-07-05 15:51:23 +02:00

Final step of the per-agent-token work (follows #59, #62, and the homelab migration).

All three consuming repos now carry their own per-agent TOKEN_* secrets:

gitea/agents, gitea/ops — org-level secrets + the agents / ops-admin teams
ffaerber/homelab — user-level secrets + bot users added as collaborators (verified via issue #137)

So the shared AGENT_TOKEN fallback is no longer used by any repo, and this PR removes it:

agent.yml — SELF_TOKEN ternary ends in ''; AGENT_TOKEN dropped from the publish + rescue step env.
publish.sh — TTOK is just the agent's own token; empty (skip) rather than falling back, if an agent ever lacks one.
README — drop the AGENT_TOKEN row; document that every consuming repo must carry the per-agent TOKEN_*.

After merge I'll delete the AGENT_TOKEN Actions secrets (org + user) and its gitea/secrets/.env entry. Verified safe: all six registry agents (pm/junior/senior/lead/qa/ops) have named tokens in every repo. YAML validated on node1.

Final step of the per-agent-token work (follows #59, #62, and the homelab migration). All three consuming repos now carry their own per-agent `TOKEN_*` secrets: - **gitea/agents**, **gitea/ops** — org-level secrets + the `agents` / `ops-admin` teams - **ffaerber/homelab** — user-level secrets + bot users added as collaborators (verified via issue #137) So the shared `AGENT_TOKEN` fallback is no longer used by any repo, and this PR removes it: - `agent.yml` — `SELF_TOKEN` ternary ends in `''`; `AGENT_TOKEN` dropped from the publish + rescue step env. - `publish.sh` — `TTOK` is just the agent's own token; empty (skip) rather than falling back, if an agent ever lacks one. - `README` — drop the `AGENT_TOKEN` row; document that every consuming repo must carry the per-agent `TOKEN_*`. After merge I'll delete the `AGENT_TOKEN` Actions secrets (org + user) and its `gitea/secrets/.env` entry. Verified safe: all six registry agents (pm/junior/senior/lead/qa/ops) have named tokens in every repo. YAML validated on node1.

ffaerber added 1 commit 2026-07-05 15:51:24 +02:00

agents: remove shared AGENT_TOKEN fallback — per-agent tokens only 3c66220f6d

All three consuming repos (gitea/agents, gitea/ops, ffaerber/homelab) now
carry the per-agent TOKEN_* secrets (org-level for gitea/*, user-level for
ffaerber/*), so the shared AGENT_TOKEN fallback is no longer needed.

- agent.yml: SELF_TOKEN ternary ends in '' instead of secrets.AGENT_TOKEN;
  removed AGENT_TOKEN from the publish + rescue step env.
- publish.sh: TTOK is just the agent's own token; if an agent somehow has none
  (TOK fell back to the built-in GT), TTOK is left empty so the trigger/merge
  is skipped rather than silently no-op'ing under the built-in token.
- README: drop the AGENT_TOKEN row; state that every consuming repo must carry
  the per-agent TOKEN_* (no shared fallback).

The AGENT_TOKEN Actions secrets (org + user) and its gitea/secrets/.env entry
are removed separately.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ffaerber merged commit 63dbd2727f into main

2026-07-05 15:51:37 +02:00

ffaerber deleted branch chore/remove-agent-token

2026-07-05 15:51:38 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: gitea/agents#63