tudor/school_compare
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): post AI review comments with the run-scoped Gitea token
PR Checks / Frontend Typecheck + Tests (pull_request) Successful in 9m37s
Details
PR Checks / Backend Smoke (pull_request) Successful in 5s
Details
PR Checks / Build Backend (no push) (pull_request) Successful in 10s
Details
PR Checks / Build Frontend (no push) (pull_request) Successful in 45s
Details
PR Checks / Build Pipeline (no push) (pull_request) Successful in 10s
Details
PR Checks / AI Code Review (Claude) (pull_request) Failing after 1m56s
Details

Browse Source 
REGISTRY_TOKEN lacks issue-write scope (403 on comment post). Gitea Actions
auto-provides a repo-scoped per-run token as secrets.GITEA_TOKEN — no
user-managed secret needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqGhF93UrpDNvXBLMjJENL
This commit is contained in:
Tudor
2026-07-03 13:39:59 +01:00
co-authored by Claude Fable 5
parent b5a63e82d4
commit c62ba0ca25
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/pr-checks.yml
+2 -1
View File
@@ -178,7 +178,8 @@ jobs:
- name: Review PR diff with Claude Code - name: Review PR diff with Claude Code
env: env:
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }} # Auto-provided per-run token from Gitea Actions (repo-scoped)
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
GITEA_SERVER_URL: ${{ gitea.server_url }} GITEA_SERVER_URL: ${{ gitea.server_url }}
GITEA_REPOSITORY: ${{ gitea.repository }} GITEA_REPOSITORY: ${{ gitea.repository }}
PR_NUMBER: ${{ gitea.event.pull_request.number }} PR_NUMBER: ${{ gitea.event.pull_request.number }}
docs/DEPLOY.md
+4 -3
View File
@@ -56,7 +56,7 @@ fail the E2E gate. That's the point: staging absorbs the risk.
| Secret | Purpose | | Secret | Purpose |
|---|---| |---|---|
| `REGISTRY_TOKEN` | push images to the registry + post PR review comments (already set) | | `REGISTRY_TOKEN` | push images to privaterepo.sitaru.org (already set) |
| `CLAUDE_CODE_OAUTH_TOKEN` | Claude Code subscription auth for the PR review — generate with `claude setup-token` on your machine | | `CLAUDE_CODE_OAUTH_TOKEN` | Claude Code subscription auth for the PR review — generate with `claude setup-token` on your machine |
| `PORTAINER_STAGING_WEBHOOK` | staging stack redeploy webhook URL | | `PORTAINER_STAGING_WEBHOOK` | staging stack redeploy webhook URL |
| `PORTAINER_PROD_WEBHOOK` | production stack redeploy webhook URL | | `PORTAINER_PROD_WEBHOOK` | production stack redeploy webhook URL |
@@ -125,7 +125,8 @@ numbers, so scheduled data refreshes don't break the gate.
`scripts/ci/ai_review.py` pipes the PR diff through headless Claude Code `scripts/ci/ai_review.py` pipes the PR diff through headless Claude Code
(`claude -p`, authenticated with the subscription OAuth token — no API (`claude -p`, authenticated with the subscription OAuth token — no API
billing), posts the structured findings as a PR comment via the Gitea API billing), posts the structured findings as a PR comment using the per-run
(reusing `REGISTRY_TOKEN`), and fails the check only when a finding is rated token Gitea Actions provides automatically (`secrets.GITEA_TOKEN` — no setup
needed), and fails the check only when a finding is rated
**severe** (would break prod, leak data, or corrupt data). Minor findings are **severe** (would break prod, leak data, or corrupt data). Minor findings are
informational and never block a merge. informational and never block a merge.