homelab/stack
1
0
Fork 0
Code Issues 70 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

fix: Gitea Actions secrets — GITEA_ prefix reserved, add provisioning sync #230

New Issue
Closed
opened 2026-03-25 04:48:08 +00:00 by kert · 1 comment
kert commented 2026-03-25 04:48:08 +00:00
Owner
Copy Link

Problem

Gitea reserves the GITEA_ prefix for Actions secrets. secrets.GITEA_TOKEN resolved to empty, causing 401 reqPackageAccess on all 28 package uploads.

Root cause

  1. Gitea Actions secret API rejects names starting with GITEA_
  2. Provisioning system syncs secrets to Woodpecker but not Gitea Actions

Fix

  • Rename secret to DEPLOY_TOKEN (maps to GITEA_TOKEN env var in workflows)
  • Add provision_gitea_actions() to src/api/auth/provision.py
  • Wire into both provision() and bootstrap() flows
  • Update all workflow generators to use secrets.DEPLOY_TOKEN
  • Set DEPLOY_TOKEN secret via API immediately to unblock CI
## Problem Gitea reserves the `GITEA_` prefix for Actions secrets. `secrets.GITEA_TOKEN` resolved to empty, causing 401 reqPackageAccess on all 28 package uploads. ## Root cause 1. Gitea Actions secret API rejects names starting with `GITEA_` 2. Provisioning system syncs secrets to Woodpecker but not Gitea Actions ## Fix - Rename secret to `DEPLOY_TOKEN` (maps to `GITEA_TOKEN` env var in workflows) - Add `provision_gitea_actions()` to `src/api/auth/provision.py` - Wire into both `provision()` and `bootstrap()` flows - Update all workflow generators to use `secrets.DEPLOY_TOKEN` - Set `DEPLOY_TOKEN` secret via API immediately to unblock CI
kert commented 2026-03-25 05:15:59 +00:00
Author
Owner
Copy Link

Fixed in f6f47b9. Same fix as #229 — see that issue for details.

Additional work:

  • GITEA_ACTIONS_SECRET_MAP in provision.py maps DEPLOY_TOKEN → GITEA_TOKEN, REGISTRY_USER → GITEA_ADMIN_USER, REGISTRY_TOKEN → GITEA_ADMIN_PASSWORD
  • Uses Gitea API PUT /repos/{owner}/{repo}/actions/secrets/{name} to create/update secrets
  • Provisioning now covers all 3 CI backends: Woodpecker (existing), Gitea Actions (new), GitHub Actions (uses same Gitea API when deployed there)

Verified: CI + deploy green.

Fixed in `f6f47b9`. Same fix as #229 — see that issue for details. Additional work: - `GITEA_ACTIONS_SECRET_MAP` in provision.py maps `DEPLOY_TOKEN` → `GITEA_TOKEN`, `REGISTRY_USER` → `GITEA_ADMIN_USER`, `REGISTRY_TOKEN` → `GITEA_ADMIN_PASSWORD` - Uses Gitea API `PUT /repos/{owner}/{repo}/actions/secrets/{name}` to create/update secrets - Provisioning now covers all 3 CI backends: Woodpecker (existing), Gitea Actions (new), GitHub Actions (uses same Gitea API when deployed there) **Verified:** CI + deploy green.
kert closed this issue 2026-03-25 05:15:59 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
REST API (FastAPI)
 auth
Authentication and authorization
 bib
Bibliography, Zotero, citations
 ci
CI/CD pipelines and Woodpecker plugins
 cli
CLI commands and UX
 cloud
Cloud provider abstraction (AWS, GCP, Azure, self-hosted)
 config
Configuration and wiring
 data
Data loading, CCLF, BCDA, seeds
 databricks
Databricks jobs and deployment
 docs
Documentation and generated references
 image:api
image:docs
image:mc
image:notebooks
image:zotero
infra
lakehouse
Nessie, Polaris, Trino, Iceberg
 llm
llm module — local RAG over comments + Zotero corpus
 notebooks
marimo notebook errors (auto-filed by nb-watcher/nb-integration)
 packaging
Python packaging, optional deps, build system
 pfs
pipeline
Pipeline execution and validation
 pipeline:ci
pipeline:deploy
pipeline:harden
pipeline:infra-ci
pipeline:rebuild-all
pipeline:release
qpp
quality
Testing, coverage, error handling
 step:build
step:deploy
step:hadolint
step:lint
step:publish
step:scan
step:test
step:validate
styles
Charts, figures, visual theming
 tree
Project directory structure and file organization
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
kert renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: homelab/stack#230
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?