gitea/agents
8
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ops: .env is the token source of truth (not tokens.md) #57

Merged
ffaerber merged 1 commits from fix/ops-env-source-of-truth into main 2026-07-05 14:01:13 +02:00
Conversation 0 Commits 1 Files Changed 1
+12 -8
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/scripts/skill-gitea-admin.sh
+12 -8
View File
@@ -59,20 +59,24 @@ curl -sS -X POST -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: applic
# 2) mint a scoped token AS that user (pick the narrowest scopes needed) # 2) mint a scoped token AS that user (pick the narrowest scopes needed)
tok=$(curl -sS -u "inter:$PW" -H "Content-Type: application/json" -X POST "$API/users/inter/tokens" \ tok=$(curl -sS -u "inter:$PW" -H "Content-Type: application/json" -X POST "$API/users/inter/tokens" \
-d '{"name":"inter","scopes":["read:repository","write:issue"]}' | jq -r '.sha1') -d '{"name":"inter","scopes":["read:repository","write:issue"]}' | jq -r '.sha1')
# 3) store it as a secret (org / repo / user level) — never print $tok # 3) store the value in BOTH places (see "Secret storage" below) — never print $tok
curl -sS -X PUT -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: application/json" \ curl -sS -X PUT -H "Authorization: token $AGENT_TOKEN" -H "Content-Type: application/json" \
"$API/orgs/gitea/actions/secrets/TOKEN_INTER" -d "$(jq -nc --arg d "$tok" '{data:$d}')" "$API/orgs/gitea/actions/secrets/TOKEN_INTER" -d "$(jq -nc --arg d "$tok" '{data:$d}')"
``` ```
Token **scopes** are groups of `read:`/`write:` on: `repository`, `issue`, `organization`, `user`, Token **scopes** are groups of `read:`/`write:` on: `repository`, `issue`, `organization`, `user`,
`package`, `notification`, `misc`, and (only for a privileged token) `admin`. `package`, `notification`, `misc`, and (only for a privileged token) `admin`.
## Token inventory — record everything in `gitea/secrets` ## Secret storage — `gitea/secrets/.env` is the SOURCE OF TRUTH
The private repo **`gitea/secrets`** (readable only by @ffaerber and @ops) is the source of truth for Every token/secret value MUST live in **`gitea/secrets/.env`** (private, readable only by @ffaerber and
tokens. Whenever you mint, rotate, or re-scope a token, append/update a row in its `tokens.md` via the @ops) as a `KEY=value` line. That file is the master; the workflows only get a secret because `.env` is
contents API (`GET` the file for its `sha`, then `PUT` the updated base64 content with that `sha`): mirrored into the org Actions secrets. So whenever you mint, rotate, or re-scope a token you MUST do
`| <token/secret name> | <owner user> | <scopes> | <Actions secret it is stored in> | <notes> |`. BOTH, in sync:
Storing the live value in the matching Actions secret is what workflows use; the `gitea/secrets` row 1. **`.env`**: `GET /repos/gitea/secrets/contents/.env` for its `sha`, add or replace the `KEY=value`
is the human-readable inventory. Never paste a token value into any issue/PR/comment/log. line, then `PUT` the updated base64 content with that `sha`.
2. **Actions secret**: `PUT /orgs/gitea/actions/secrets/{KEY}` with the same value (what runs use).
When you DELETE a token, remove it from BOTH. Keep `gitea/secrets/README.md` (the table describing what
each KEY is) up to date. Do NOT use `tokens.md` — the values live in `.env`. NEVER paste a token value
into any issue/PR/comment/log; it only ever goes into `.env` and the Actions secret.
## Change a user's token scope (the "update my token" flow) ## Change a user's token scope (the "update my token" flow)
Tokens are immutable — you can't edit scopes. Re-mint: delete the old token and create a new one, Tokens are immutable — you can't edit scopes. Re-mint: delete the old token and create a new one,