Merge pull request 'fix(detail): render & correctly date Ofsted report cards' (#62 ) from fix/detail-report-card-render-date into main

Reviewed-on: #62
Merge pull request 'fix(ci): promotion E2E-gate check uses Actions token, not REGISTRY_TOKEN (403)' (#61 ) from fix/promote-status-token into main
2026-07-18 18:13:25 +00:00 · 2026-07-18 15:25:28 +00:00 · 2026-07-18 16:20:03 +01:00
1 changed files with 4 additions and 1 deletions
@@ -67,9 +67,12 @@ jobs:
          echo "Promoting $FULL_SHA (images tagged $SHORT_SHA)"

      - name: Verify the staging E2E gate passed for this commit
+        # Use the built-in Actions token (GITHUB_TOKEN is the documented name;
+        # it carries repository read scope), NOT REGISTRY_TOKEN — the registry
+        # token has no repo scope, so the commit-status API returns 403.
        run: |
          STATUS_JSON=$(curl -fsS \
-            -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
            "https://${REGISTRY}/api/v1/repos/${{ gitea.repository }}/commits/${{ steps.resolve.outputs.full }}/status")
          echo "$STATUS_JSON" | python3 -c "
          import json, sys
Author	SHA1	Message	Date
tudor	74bdbebd57	Merge pull request 'fix(detail): render & correctly date Ofsted report cards' (#62 ) from fix/detail-report-card-render-date into main Stage (build -> staging -> E2E gate) / Build Backend (FastAPI) (push) Successful in 14s Details Stage (build -> staging -> E2E gate) / Build Frontend (Next.js) (push) Successful in 54s Details Stage (build -> staging -> E2E gate) / Build Pipeline (Meltano + dbt + Airflow) (push) Successful in 13s Details Stage (build -> staging -> E2E gate) / Deploy to Staging (push) Successful in 19s Details Stage (build -> staging -> E2E gate) / E2E Journeys against Staging (push) Successful in 40s Details Reviewed-on: #62	2026-07-18 18:13:25 +00:00
tudor	b05f3bebc7	Merge pull request 'fix(ci): promotion E2E-gate check uses Actions token, not REGISTRY_TOKEN (403)' (#61 ) from fix/promote-status-token into main Stage (build -> staging -> E2E gate) / Build Backend (FastAPI) (push) Successful in 14s Details Stage (build -> staging -> E2E gate) / Build Frontend (Next.js) (push) Successful in 54s Details Stage (build -> staging -> E2E gate) / Build Pipeline (Meltano + dbt + Airflow) (push) Successful in 12s Details Stage (build -> staging -> E2E gate) / Deploy to Staging (push) Successful in 1s Details Stage (build -> staging -> E2E gate) / E2E Journeys against Staging (push) Successful in 44s Details Reviewed-on: #61	2026-07-18 15:25:28 +00:00
TudorandClaude Fable 5	ce422e6436	fix(ci): use the Actions token, not REGISTRY_TOKEN, to read the E2E commit status PR Checks / Frontend Typecheck + Tests (pull_request) Successful in 1m5s Details PR Checks / Backend Smoke (pull_request) Successful in 7s Details PR Checks / Build Backend (no push) (pull_request) Successful in 11s Details PR Checks / Build Frontend (no push) (pull_request) Successful in 47s Details PR Checks / Build Pipeline (no push) (pull_request) Successful in 10s Details PR Checks / AI Code Review (Claude) (pull_request) Successful in 36s Details Promotion's 'Verify the staging E2E gate' step called the Gitea commit-status API with REGISTRY_TOKEN, which has container-registry scope but no repository scope — so the API returned 403 and promotion failed. Switch to the built-in GITHUB_TOKEN (repo read scope), matching how pr-checks.yml already authenticates to the Gitea API. REGISTRY_TOKEN is still used for the docker registry login, which is its correct scope. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0146VHeLAWjDVE2B5uU67jCB	2026-07-18 16:20:03 +01:00