tudor/school_compare
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): post AI review comments with the run-scoped Gitea token
PR Checks / Frontend Typecheck + Tests (pull_request) Successful in 9m37s
Details
PR Checks / Backend Smoke (pull_request) Successful in 5s
Details
PR Checks / Build Backend (no push) (pull_request) Successful in 10s
Details
PR Checks / Build Frontend (no push) (pull_request) Successful in 45s
Details
PR Checks / Build Pipeline (no push) (pull_request) Successful in 10s
Details
PR Checks / AI Code Review (Claude) (pull_request) Failing after 1m56s
Details

Browse Source 
REGISTRY_TOKEN lacks issue-write scope (403 on comment post). Gitea Actions
auto-provides a repo-scoped per-run token as secrets.GITEA_TOKEN — no
user-managed secret needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqGhF93UrpDNvXBLMjJENL
This commit is contained in:
Tudor
2026-07-03 13:39:59 +01:00
co-authored by Claude Fable 5
parent b5a63e82d4
commit c62ba0ca25
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/DEPLOY.md
+4 -3
View File
@@ -56,7 +56,7 @@ fail the E2E gate. That's the point: staging absorbs the risk.
| Secret | Purpose |
|---|---|
| `REGISTRY_TOKEN` | push images to the registry + post PR review comments (already set) |
| `REGISTRY_TOKEN` | push images to privaterepo.sitaru.org (already set) |
| `CLAUDE_CODE_OAUTH_TOKEN` | Claude Code subscription auth for the PR review — generate with `claude setup-token` on your machine |
| `PORTAINER_STAGING_WEBHOOK` | staging stack redeploy webhook URL |
| `PORTAINER_PROD_WEBHOOK` | production stack redeploy webhook URL |
@@ -125,7 +125,8 @@ numbers, so scheduled data refreshes don't break the gate.
`scripts/ci/ai_review.py` pipes the PR diff through headless Claude Code
(`claude -p`, authenticated with the subscription OAuth token — no API
billing), posts the structured findings as a PR comment via the Gitea API
(reusing `REGISTRY_TOKEN`), and fails the check only when a finding is rated
billing), posts the structured findings as a PR comment using the per-run
token Gitea Actions provides automatically (`secrets.GITEA_TOKEN` — no setup
needed), and fails the check only when a finding is rated
**severe** (would break prod, leak data, or corrupt data). Minor findings are
informational and never block a merge.