neuron-technologies/neuron-web
3
0
Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

ci: use CHECKOUT_TOKEN repo secret for cross-repo engram-lang checkout
Deploy marketing to Cloud Run / deploy (push) Failing after 6s
Details

Browse Source 
The auto-issued GITHUB_TOKEN is scoped to the current repo only, so
cross-repo actions/checkout needs an explicit token. CHECKOUT_TOKEN
holds an admin-scoped Gitea API token; long-term we should switch to
a dedicated read-only PAT.
This commit is contained in:
Will Anderson
2026-05-02 12:54:35 -05:00
parent 248ff89230
commit 4629796a75
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yaml
+6 -4
View File
@@ -42,10 +42,12 @@ jobs:
repository: neuron-technologies/engram-lang repository: neuron-technologies/engram-lang
path: engram-lang path: engram-lang
fetch-depth: 1 fetch-depth: 1
# Gitea Actions auto-issues GITHUB_TOKEN scoped to the workflow run. # Gitea-issued GITHUB_TOKEN is workflow-scoped to the current repo
# That token has read access to other repos in the same org by # only. Cross-repo checkout needs a token with read access to
# default, so cross-repo checkout just works. # neuron-technologies/engram-lang. CHECKOUT_TOKEN holds Will's
token: ${{ secrets.GITHUB_TOKEN }} # admin API token (sourced from ~/Secrets/api-keys/gitea-api-token).
# Long-term: provision a dedicated read-only PAT.
token: ${{ secrets.CHECKOUT_TOKEN }}
- name: Stage engram-lang as foundation/el for build-stage.sh - name: Stage engram-lang as foundation/el for build-stage.sh
run: | run: |