fix(renovate): document and probe the five token scopes Renovate needs; lint daemon-bound actions
Run 350 cleared platform init (/user 200, /version 200, /repos 200), then stopped at GET /api/v1/orgs/Home-Network with Gitea's own 403: token does not have at least one of required scope(s), required=[read:organization], token scope=read:package,write:repository,read:user The workflow's header listed only those three scopes, and the operator minted exactly that. Renovate's initRepo -> isOrg needs read:organization, and Gitea files /issues and /labels under the issue scope, which the dashboard and PR labels need: write:issue. - renovate.yaml: corrects the scope list (read:user, read:organization, write:repository, write:issue, read:package), with the call each serves. A new preflight step probes them with GETs, the token passed to curl on stdin, and names a missing scope instead of Renovate's bare "Authentication failure". - ci/lint.sh: rejects workflow `uses:` lines that need a Docker daemon (docker://, renovatebot/github-action, docker/*-action), the class fixed in #84. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 5.5 committed
1 parent
d550a501e2
commit
0c6ee4921d
3 files changed
+212
-7
No files matched your search
@@ -60,9 +60,21 @@
|
||||
# entry's "What I did NOT verify" — that gap is stated, not papered over.
|
||||
#
|
||||
# OPERATOR PREREQUISITE — ONE SECRET, NOT COMMITTED HERE:
|
||||
# `RENOVATE_TOKEN` — a Gitea access token for the bot account, scopes `write:repository`,
|
||||
# `read:user` and (since 2026-10-29) `read:package`. Set it as an Actions secret on this
|
||||
# repository. Nothing in this repo mints,
|
||||
# `RENOVATE_TOKEN` — a Gitea access token for the bot account (`renovate-bot`) with FIVE scopes.
|
||||
# Each is required by a call Renovate 44.x makes against Gitea 1.24.3, and Gitea refuses a
|
||||
# token missing one with `403 token does not have at least one of required scope(s)`:
|
||||
# read:user GET /user (platform init: initPlatform)
|
||||
# read:organization GET /orgs/{owner}, /orgs/{o}/labels (initRepo -> isOrg, then org labels)
|
||||
# write:repository clone/push branches, /pulls, /statuses
|
||||
# write:issue /issues, /labels, /issues/{n}/labels (dependency dashboard, PR labels;
|
||||
# Gitea files all of these under the ISSUE scope, not repository)
|
||||
# read:package the Gitea container registry (RENOVATE_HOST_RULES below)
|
||||
# CORRECTED 2026-10-30. This list used to name only write:repository + read:user (+ read:package),
|
||||
# and the operator minted exactly that. Run 350 then failed at
|
||||
# `GET /api/v1/orgs/Home-Network 403 ... required=[read:organization], token scope=read:package,
|
||||
# write:repository,read:user`; write:issue would have been the next wall. The preflight below now
|
||||
# PROBES these scopes, so a short token fails in seconds with the missing scope named.
|
||||
# Set it as an Actions secret on this repository. Nothing in this repo mints,
|
||||
# stores or references its value; it is consumed by name only.
|
||||
# Until it exists, this workflow FAILS LOUDLY on every scheduled run. That is intended: a
|
||||
# visible red is the correct state for "automation configured but not credentialed".
|
||||
@@ -161,10 +173,10 @@ jobs:
|
||||
That is the failure mode that let renovate.json sit inert in this repo for months while
|
||||
seven files claimed "Renovate maintains this pin".
|
||||
|
||||
TO FIX: create a Gitea access token for the bot account with scopes
|
||||
`write:repository`, `read:user` and `read:package` (the last one lets Renovate read
|
||||
this repo's own images in the Gitea registry), then add it to this repository as the
|
||||
Actions secret RENOVATE_TOKEN. Do not commit it anywhere.
|
||||
TO FIX: create a Gitea access token for the bot account (renovate-bot) with scopes
|
||||
read:user, read:organization, write:repository, write:issue and read:package (the
|
||||
header of .gitea/workflows/renovate.yaml says which call needs which), then add it to
|
||||
this repository as the Actions secret RENOVATE_TOKEN. Do not commit it anywhere.
|
||||
MSG
|
||||
exit 1
|
||||
fi
|
||||
@@ -172,6 +184,75 @@ jobs:
|
||||
# Proves the step is running INSIDE the pinned Renovate image, not the default job image.
|
||||
echo "renovate $(renovate --version)"
|
||||
|
||||
- name: Preflight - the token has every scope Renovate needs
|
||||
shell: bash
|
||||
env:
|
||||
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
||||
# ADDED 2026-10-30. Renovate reports EVERY platform-init failure as the bare
|
||||
# "Authentication failure" (lib/modules/platform/gitea/index.ts initPlatform swallows the
|
||||
# HTTP error), and a later scope gap surfaces as "Repository has unknown error". Two
|
||||
# dispatches were spent learning one missing scope at a time. These probes are GETs only,
|
||||
# and they name the missing scope. The token never reaches argv: curl reads it from stdin
|
||||
# (`--config -`), so it is not in `ps` output or in the log.
|
||||
run: |
|
||||
set -uo pipefail
|
||||
GITEA=https://gitea.home.keithjackson.dev
|
||||
REPO=Home-Network/home-network-k3s-impl
|
||||
fail=0
|
||||
body=$(mktemp)
|
||||
probe() { # <scope it proves> <path> <auth: bearer|basic>
|
||||
local code
|
||||
if [ "$3" = basic ]; then
|
||||
code=$(printf 'user = "renovate:%s"\n' "$RENOVATE_TOKEN" \
|
||||
| curl -sS --config - -o "$body" -w '%{http_code}' "$GITEA$2") || code=000
|
||||
else
|
||||
code=$(printf 'header = "Authorization: Bearer %s"\n' "$RENOVATE_TOKEN" \
|
||||
| curl -sS --config - -o "$body" -w '%{http_code}' "$GITEA$2") || code=000
|
||||
fi
|
||||
if [ "$code" = 200 ]; then
|
||||
echo "ok $1 (GET ${2%%\?*} -> 200)"
|
||||
return
|
||||
fi
|
||||
fail=1
|
||||
echo "::error::scope $1: GET ${2%%\?*} -> $code"
|
||||
case "$code" in
|
||||
401) echo " 401 = Gitea rejected the token VALUE (wrong, expired or revoked)." ;;
|
||||
403) if grep -q 'Access denied' "$body"; then
|
||||
echo " 403 'Access denied' = a Cilium/Envoy policy denial, not Gitea."
|
||||
else
|
||||
echo " Gitea: $(jq -r '.message // empty' "$body" 2>/dev/null | head -c 300)"
|
||||
fi ;;
|
||||
*) echo " body: $(head -c 200 "$body")" ;;
|
||||
esac
|
||||
}
|
||||
probe read:user "/api/v1/user" bearer
|
||||
probe read:organization "/api/v1/orgs/${REPO%%/*}" bearer
|
||||
probe read:repository "/api/v1/repos/$REPO" bearer
|
||||
probe read:issue "/api/v1/repos/$REPO/labels?limit=1" bearer
|
||||
probe read:package "/v2/token?service=container_registry&scope=repository:home-network/toolbox:pull" basic
|
||||
# WRITE scopes cannot be proven by a GET. Gitea's scope-refusal message, however, lists
|
||||
# the token's scopes (names only, never the value): ask for an admin route this bot
|
||||
# cannot have, and read `token scope=` from the 403. Advisory if the format changes.
|
||||
printf 'header = "Authorization: Bearer %s"\n' "$RENOVATE_TOKEN" \
|
||||
| curl -sS --config - -o "$body" "$GITEA/api/v1/admin/orgs?limit=1" || true
|
||||
scopes=$(jq -r '.message // empty' "$body" 2>/dev/null | sed -n 's/.*token scope=//p')
|
||||
if [ -n "$scopes" ]; then
|
||||
echo "token scopes (from Gitea): $scopes"
|
||||
for want in write:repository write:issue; do
|
||||
case ",$scopes," in
|
||||
*",$want,"*|*",all,"*) echo "ok $want" ;;
|
||||
*) echo "::error::scope $want is missing (token scope=$scopes)"; fail=1 ;;
|
||||
esac
|
||||
done
|
||||
else
|
||||
echo "::warning::could not read the token's scope list; write:repository and write:issue are UNVERIFIED"
|
||||
fi
|
||||
rm -f "$body"
|
||||
if [ "$fail" -ne 0 ]; then
|
||||
echo "::error::RENOVATE_TOKEN failed the checks above (a 401 is the value, a 403 is a scope). Re-mint it for renovate-bot with read:user, read:organization, write:repository, write:issue, read:package and overwrite the secret."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Run Renovate
|
||||
shell: bash
|
||||
# The repo config is discovered by Renovate from the cloned repo (renovate.json5,
|
||||
|
||||
Reference in new issue
Block a user