From ce422e64363e2b03c186ef316832b6de15502d67 Mon Sep 17 00:00:00 2001 From: Tudor Date: Sat, 18 Jul 2026 16:20:03 +0100 Subject: [PATCH] fix(ci): use the Actions token, not REGISTRY_TOKEN, to read the E2E commit status MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Promotion's 'Verify the staging E2E gate' step called the Gitea commit-status API with REGISTRY_TOKEN, which has container-registry scope but no repository scope — so the API returned 403 and promotion failed. Switch to the built-in GITHUB_TOKEN (repo read scope), matching how pr-checks.yml already authenticates to the Gitea API. REGISTRY_TOKEN is still used for the docker registry login, which is its correct scope. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_0146VHeLAWjDVE2B5uU67jCB --- .gitea/workflows/promote.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/promote.yml b/.gitea/workflows/promote.yml index 703c4ff..777530c 100644 --- a/.gitea/workflows/promote.yml +++ b/.gitea/workflows/promote.yml @@ -67,9 +67,12 @@ jobs: echo "Promoting $FULL_SHA (images tagged $SHORT_SHA)" - name: Verify the staging E2E gate passed for this commit + # Use the built-in Actions token (GITHUB_TOKEN is the documented name; + # it carries repository read scope), NOT REGISTRY_TOKEN — the registry + # token has no repo scope, so the commit-status API returns 403. run: | STATUS_JSON=$(curl -fsS \ - -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \ + -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ "https://${REGISTRY}/api/v1/repos/${{ gitea.repository }}/commits/${{ steps.resolve.outputs.full }}/status") echo "$STATUS_JSON" | python3 -c " import json, sys