The Promote to Production run failed at Verify the staging E2E gate passed for this commit with curl: (22) ... 403.
Cause
The step reads the Gitea commit-status API using secrets.REGISTRY_TOKEN. That token has container-registry scope but no repository scope, so the API authenticates it (not a 401) but forbids the repo read → 403.
Fix
Authenticate the status check with the built-in Actions token secrets.GITHUB_TOKEN (repository read scope) — the same token pr-checks.yml already uses for Gitea API calls (aliased there as GITEA_TOKEN). REGISTRY_TOKEN stays on the docker-registry login, which is its correct scope.
One-line change; no permissions: block in the workflow restricts the token, so its default repo read access applies.
The **Promote to Production** run failed at *Verify the staging E2E gate passed for this commit* with `curl: (22) ... 403`.
## Cause
The step reads the Gitea commit-status API using `secrets.REGISTRY_TOKEN`. That token has **container-registry scope but no repository scope**, so the API authenticates it (not a 401) but forbids the repo read → **403**.
## Fix
Authenticate the status check with the built-in Actions token `secrets.GITHUB_TOKEN` (repository read scope) — the same token `pr-checks.yml` already uses for Gitea API calls (aliased there as `GITEA_TOKEN`). `REGISTRY_TOKEN` stays on the docker-registry login, which is its correct scope.
One-line change; no `permissions:` block in the workflow restricts the token, so its default repo read access applies.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_0146VHeLAWjDVE2B5uU67jCB
Promotion's 'Verify the staging E2E gate' step called the Gitea
commit-status API with REGISTRY_TOKEN, which has container-registry scope
but no repository scope — so the API returned 403 and promotion failed.
Switch to the built-in GITHUB_TOKEN (repo read scope), matching how
pr-checks.yml already authenticates to the Gitea API. REGISTRY_TOKEN is
still used for the docker registry login, which is its correct scope.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0146VHeLAWjDVE2B5uU67jCB
This PR swaps the token used to query the Gitea commit-status API in the manual production-promotion workflow from REGISTRY_TOKEN (package-registry scoped, causing 403s) to the built-in GITHUB_TOKEN (repo-scoped), with a comment explaining why. This is a narrow, well-justified fix to the E2E gate check that guards production promotion, and the rest of the already-hardened workflow (env-isolated SHA input, ancestry check, concurrency guard) is untouched.
✅ No issues found.
## 🤖 AI Code Review (Claude Code)
This PR swaps the token used to query the Gitea commit-status API in the manual production-promotion workflow from REGISTRY_TOKEN (package-registry scoped, causing 403s) to the built-in GITHUB_TOKEN (repo-scoped), with a comment explaining why. This is a narrow, well-justified fix to the E2E gate check that guards production promotion, and the rest of the already-hardened workflow (env-isolated SHA input, ancestry check, concurrency guard) is untouched.
✅ No issues found.
tudor
merged commit b05f3bebc7 into main2026-07-18 15:25:28 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The Promote to Production run failed at Verify the staging E2E gate passed for this commit with
curl: (22) ... 403.Cause
The step reads the Gitea commit-status API using
secrets.REGISTRY_TOKEN. That token has container-registry scope but no repository scope, so the API authenticates it (not a 401) but forbids the repo read → 403.Fix
Authenticate the status check with the built-in Actions token
secrets.GITHUB_TOKEN(repository read scope) — the same tokenpr-checks.ymlalready uses for Gitea API calls (aliased there asGITEA_TOKEN).REGISTRY_TOKENstays on the docker-registry login, which is its correct scope.One-line change; no
permissions:block in the workflow restricts the token, so its default repo read access applies.🤖 Generated with Claude Code
https://claude.ai/code/session_0146VHeLAWjDVE2B5uU67jCB
🤖 AI Code Review (Claude Code)
This PR swaps the token used to query the Gitea commit-status API in the manual production-promotion workflow from REGISTRY_TOKEN (package-registry scoped, causing 403s) to the built-in GITHUB_TOKEN (repo-scoped), with a comment explaining why. This is a narrow, well-justified fix to the E2E gate check that guards production promotion, and the rest of the already-hardened workflow (env-isolated SHA input, ancestry check, concurrency guard) is untouched.
✅ No issues found.