From e993d0f7d17cf66cdf9a19a05c1302e2847c09fb Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Tue, 29 Sep 2026 19:30:35 -0500 Subject: [PATCH] docs(ci): the wiring comment named a secret Gitea cannot accept ci/gitea-settings.sh told the reader to "create a Gitea repo secret GITEA_SETTINGS_TOKEN". That instruction is IMPOSSIBLE to follow: Gitea reserves the GITEA_ prefix for secret names and rejects the PUT with HTTP 400 "invalid secret name". Same defect as the one fixed in PR #15 and in the README in PR #19 -- this was the third file carrying it, found by an agent reading the file rather than trusting my description of it. A comment that instructs an impossible action is not cosmetic: this exact wrong name is why the drift detector sat inert while a token existed and no secret did. Now names SETTINGS_API_TOKEN, and states explicitly that GITEA_SETTINGS_TOKEN remains honoured ONLY as a local-run env var -- it can never be the CI wiring, because the secret that would feed it cannot exist. Co-Authored-By: Claude Opus 5 (1M context) --- ci/gitea-settings.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/ci/gitea-settings.sh b/ci/gitea-settings.sh index 483e13c..0f2f156 100755 --- a/ci/gitea-settings.sh +++ b/ci/gitea-settings.sh @@ -42,9 +42,16 @@ # skip like spec-immutability's (UNDETERMINED, exit 3) rather than a hard block, so # that an unwired credential cannot lock the repository. # -# TO WIRE IT: create a Gitea repo secret GITEA_SETTINGS_TOKEN (a token that can read repo +# TO WIRE IT: create a Gitea repo secret SETTINGS_API_TOKEN (a token that can read repo # settings) — infra/gitea/set-ci-token.sh does it. Until then this stage skips LOUDLY and # the drift it exists to catch is still undetected. +# +# NOT `GITEA_SETTINGS_TOKEN`. This comment named that until 2026-09-29 and it instructed the +# reader to do something IMPOSSIBLE: Gitea reserves the `GITEA_` prefix for secret names and +# rejects the PUT with HTTP 400 "invalid secret name". That is not a style rule — it is why the +# detector sat inert for hours while a token existed and no secret did. The env var below still +# accepts GITEA_SETTINGS_TOKEN, but only for a LOCAL run: it can never be the CI wiring, because +# the secret that would feed it cannot be created at all. set -euo pipefail CI_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" REPO_ROOT="$(cd "${CI_DIR}/.." && pwd)" -- 2.54.0