Use bare tokens: PAT_FOR_GITHUB replaces CREDENTIALS_FOR_GITHUB

The sync workflow reads secrets.PAT_FOR_GITHUB as clear text and
parse_github_token and parse_gitea_token only check that the value is not
empty. No secret is JSON any more; the wiki publisher follows. Update the
tests, the guides, the README, PP-001 UC candidate 2 and the wiki pages with
their Danish and Bahasa Malaysia translations.

Task: MIL-002#5

.gitea/scoped_workflows/sync-github-metadata.yml

@@ -18,7 +18,7 @@ jobs:
           GITEA_API_URL: ${{ gitea.api_url }}
           GITEA_CREDENTIALS: ${{ secrets.TOKEN_FOR_GITEA }}
           SOURCE_REPOSITORY: ${{ gitea.repository }}
-          GITHUB_CREDENTIALS: ${{ secrets.CREDENTIALS_FOR_GITHUB }}
+          PAT_FOR_GITHUB: ${{ secrets.PAT_FOR_GITHUB }}
         run: |
           python3 - <<'PY'
           import json
@@ -87,61 +87,22 @@ jobs:
                   ) from None
 
 
-          def parse_github_token(raw_credentials):
+          def parse_github_token(raw_token):
-              raw_credentials = (raw_credentials or "").strip()
+              token = (raw_token or "").strip()
-              if not raw_credentials:
+              if not token:
                   raise WorkflowError(
-                      "configuration", "CREDENTIALS_FOR_GITHUB is missing or empty."
+                      "configuration", "PAT_FOR_GITHUB is missing or empty."
                   )
-
+              return token
-              try:
-                  credentials = json.loads(raw_credentials)
-              except json.JSONDecodeError:
-                  raise WorkflowError(
-                      "configuration",
-                      "CREDENTIALS_FOR_GITHUB must contain valid JSON.",
-                  ) from None
-
-              if not isinstance(credentials, dict):
-                  raise WorkflowError(
-                      "configuration",
-                      "CREDENTIALS_FOR_GITHUB must be a JSON object.",
-                  )
-
-              token = credentials.get("GITHUB_PAT")
-              if not isinstance(token, str) or not token.strip():
-                  raise WorkflowError(
-                      "configuration",
-                      "CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.",
-                  )
-              return token.strip()
 
 
-          def parse_gitea_token(raw_credentials):
+          def parse_gitea_token(raw_token):
-              raw_credentials = (raw_credentials or "").strip()
+              token = (raw_token or "").strip()
-              if not raw_credentials:
+              if not token:
                   raise WorkflowError(
                       "configuration", "TOKEN_FOR_GITEA is missing or empty."
                   )
-
+              return token
-              try:
-                  credentials = json.loads(raw_credentials)
-              except json.JSONDecodeError:
-                  token = raw_credentials
-              else:
-                  if isinstance(credentials, dict):
-                      token = credentials.get("GITEA_TOKEN")
-                  elif isinstance(credentials, str):
-                      token = credentials
-                  else:
-                      token = None
-
-              if not isinstance(token, str) or not token.strip():
-                  raise WorkflowError(
-                      "configuration",
-                      "TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.",
-                  )
-              return token.strip()
 
 
           def split_repository(full_name):
@@ -219,7 +180,7 @@ jobs:
                   )
                   return 0
 
-              github_token = parse_github_token(os.environ.get("GITHUB_CREDENTIALS"))
+              github_token = parse_github_token(os.environ.get("PAT_FOR_GITHUB"))
               github_owner, github_repo = target
               github_api_url = (
                   "https://api.github.com/repos/"

README.md

@@ -23,8 +23,8 @@ It currently contains the Gitea workflow [`sync-github-metadata.yml`](.gitea/sco
 - A Gitea instance with Actions enabled and a runner providing `ubuntu-latest` with `python3`
 - A configured GitHub push mirror on the Gitea repository (at most one; repositories without a mirror are skipped successfully)
 - Repository secrets:
-  - `TOKEN_FOR_GITEA`: Gitea API token (plain string, or JSON with `GITEA_TOKEN`)
+  - `TOKEN_FOR_GITEA`: Gitea API token (the token only, no JSON)
-  - `CREDENTIALS_FOR_GITHUB`: JSON object containing `GITHUB_PAT`, a GitHub personal access token allowed to edit the mirror repository
+  - `PAT_FOR_GITHUB`: a GitHub personal access token allowed to edit the mirror repository (the token only, no JSON)
   - `TOKEN_FOR_GITEA_WIKI` (optional, only in this repository, for the **Publish wiki** workflow): Gitea token that can write the repository wiki; when it is absent, `TOKEN_FOR_GITEA` is used and needs write access
 
 ## 🛠️ Setup
@@ -96,7 +96,7 @@ activate Workflow
 Workflow -> Workflow: Read and validate secrets
 note right
 TOKEN_FOR_GITEA
-CREDENTIALS_FOR_GITHUB
+PAT_FOR_GITHUB
 end note
 
 alt secret validation failed

docs/project-plan.md

@@ -9,8 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Added gateway MIL-005 (wiki and translations) | [08ef26a] |
+| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Last decision date is 2026-12-12 after adding MIL-005 | [ae4e257] |
-| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Last decision date is 2026-12-12 after adding MIL-005 | [ae4e257] |
+| 2026-10-10 | Proposed | Jens Tirsvad Nielsen | S01 | UC candidate 2 names the secret PAT_FOR_GITHUB | pending |
 
 ---
 
@@ -134,7 +134,7 @@ no tests, no release process.
 - **Trigger:** onboarding a repository or rotating a token.
 - **Preconditions:** access to Gitea and GitHub settings.
 - **Success:** a workflow run passes credential checks with the documented minimum permissions.
-- **Main flow:** create the tokens, store `TOKEN_FOR_GITEA` and `CREDENTIALS_FOR_GITHUB`, run the workflow, read the validation result.
+- **Main flow:** create the tokens, store `TOKEN_FOR_GITEA` and `PAT_FOR_GITHUB`, run the workflow, read the validation result.
 - **Alternatives and failures:** malformed JSON, empty value, expired token, missing permission: the check names the category without printing the secret.
 - **Dependencies:** use case 1.
 
@@ -252,5 +252,4 @@ no tests, no release process.
 [Milestone MIL-003]: https://git.tirsystem.com/TirSystem/github-action/milestone/20
 [Milestone MIL-004]: https://git.tirsystem.com/TirSystem/github-action/milestone/21
 [Milestone MIL-005]: https://git.tirsystem.com/TirSystem/github-action/milestone/93
-[08ef26a]: https://git.tirsystem.com/TirSystem/github-action/commit/08ef26a6d3eb98c066b45634c2271e578e6c0a0b
 [ae4e257]: https://git.tirsystem.com/TirSystem/github-action/commit/ae4e257236095e76132980fad1e9a661b1d082c7

guides/credentials.md

@@ -6,8 +6,8 @@ leaves.
 
 | Secret | Content | Used for |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA` | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Reading the repository (description, topics) and its push mirrors |
+| `TOKEN_FOR_GITEA` | The Gitea token, nothing else | Reading the repository (description, topics) and its push mirrors |
-| `CREDENTIALS_FOR_GITHUB` | JSON object with a non-empty `GITHUB_PAT` | Changing the description and topics of the GitHub mirror |
+| `PAT_FOR_GITHUB` | The GitHub token, nothing else | Changing the description and topics of the GitHub mirror |
 
 ## Minimum permissions
 
@@ -34,11 +34,9 @@ Calls made: `GET /repos/{owner}/{repo}` and `GET /repos/{owner}/{repo}/push_mirr
 Calls made: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (description)
 and `PUT /repos/{owner}/{repo}/topics`.
 
-Format of `CREDENTIALS_FOR_GITHUB`:
+Format of `PAT_FOR_GITHUB`: only the token string (for example
-
+`github_pat_...`), as clear text. The workflow only checks that it is not empty;
-```json
+GitHub rejects a wrong value (HTTP 401).
-{"GITHUB_PAT": "<token>"}
-```
 
 ## What the workflow checks before it changes anything
 
@@ -64,7 +62,7 @@ when that secret exists and otherwise reuses `TOKEN_FOR_GITEA`.
 
 | Secret | Content | Used for |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA_WIKI` (optional) | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Writing the wiki pages of this repository |
+| `TOKEN_FOR_GITEA_WIKI` (optional) | The Gitea token, nothing else | Writing the wiki pages of this repository |
 
 - The token that is used needs scope `write:repository`, and its user needs
   write access to this repository. Gitea has no wiki-only scope.

guides/onboarding.md

@@ -27,7 +27,7 @@ Until delivery is verified, onboard a repository by copying the workflow (below)
 3. **Add the two secrets** in the repository (or organization) settings,
    using the scopes in [credentials.md](credentials.md):
    - `TOKEN_FOR_GITEA`
-   - `CREDENTIALS_FOR_GITHUB` (JSON with `GITHUB_PAT`)
+   - `PAT_FOR_GITHUB` (the GitHub token only)
 4. **Deliver the workflow:**
    - *If scoped workflows apply to the repository:* nothing to copy.
    - *Otherwise:* copy `.gitea/scoped_workflows/sync-github-metadata.yml`

guides/troubleshooting.md

@@ -22,12 +22,8 @@ never starts, or stops before the step) is a **runner** problem.
 
 | Message (start) | Category | Cause and fix |
 | --- | --- | --- |
-| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
+| `PAT_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
-| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | The value must be JSON such as `{"GITHUB_PAT": "..."}` |
-| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Use an object, not a list or string |
-| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Add the `GITHUB_PAT` key with a token |
 | `TOKEN_FOR_GITEA is missing or empty.` | configuration | Add the secret |
-| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | The JSON form needs a `GITEA_TOKEN` key |
 | `Could not determine the Gitea source repository.` | configuration | The run has no repository name; report as a defect |
 | `Expected at most one GitHub push mirror ... found N` | configuration | Keep one GitHub push mirror |
 | `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Wiki publishing only: add one of the secrets (see [credentials.md](credentials.md)) |
@@ -36,7 +32,7 @@ never starts, or stops before the step) is a **runner** problem.
 | `The wiki source directory ... has no Markdown pages` | configuration | Wiki publishing only: `wiki/` is empty or missing; nothing was changed |
 | `Could not determine the GitHub owner and repository ...` | configuration | The mirror address must look like `https://github.com/<owner>/<repo>.git` |
 | `Gitea API request failed with HTTP 401` | credentials | Create a new Gitea token and update `TOKEN_FOR_GITEA` |
-| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `CREDENTIALS_FOR_GITHUB` |
+| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `PAT_FOR_GITHUB`; the value must be the token only (no name, quotes or JSON) |
 | `... HTTP 403 ...` (Gitea) | permissions | Token needs `read:repository`, and its user needs administrator access to the repository |
 | `... HTTP 403 ...` (GitHub) | permissions | Token needs Administration read and write on the mirror repository |
 | `The GitHub token cannot administer <repo>` | permissions | Same as above; the token can read the repository but not edit it |

tests/test_publish_wiki.py

@@ -29,19 +29,15 @@ def b64(text: str) -> str:
 
 
 class TestParseGiteaToken:
-    def test_accepts_bare_token(self):
+    def test_returns_the_stripped_token(self):
-        assert publish_wiki.parse_gitea_token(" abc ") == "abc"
+        assert publish_wiki.parse_gitea_token(" abc \n") == "abc"
 
-    def test_accepts_json_object_and_string(self):
+    @pytest.mark.parametrize("raw", [None, "", "  "])
-        assert publish_wiki.parse_gitea_token('{"GITEA_TOKEN": "abc"}') == "abc"
-        assert publish_wiki.parse_gitea_token('"abc"') == "abc"
-
-    @pytest.mark.parametrize("raw", [None, "", "  ", "{}", '{"GITEA_TOKEN": ""}', "[1]"])
     def test_rejects_missing_or_empty_token(self, raw):
         with pytest.raises(publish_wiki.WorkflowError) as caught:
             publish_wiki.parse_gitea_token(raw)
         assert caught.value.category == "configuration"
-        assert "TOKEN_FOR_GITEA" in str(caught.value) or "wiki token" in str(caught.value)
+        assert "No token for the wiki" in str(caught.value)
 
 
 class TestReadPages:

tests/test_sync_github_metadata.py

@@ -15,49 +15,28 @@ def sync():
 
 
 class TestGithubToken:
-    def test_returns_stripped_token_from_json_object(self, sync):
+    def test_returns_the_stripped_token(self, sync):
-        raw = json.dumps({"GITHUB_PAT": "  ghp_abc  "})
+        assert sync["parse_github_token"]("  ghp_abc\n") == "ghp_abc"
-        assert sync["parse_github_token"](raw) == "ghp_abc"
+
+    def test_accepts_a_fine_grained_token(self, sync):
+        token = "github_pat_11ABCDEFG0abcdefghijkl_mnopqrstuvwxyz0123456789"
+        assert sync["parse_github_token"](token) == token
 
     @pytest.mark.parametrize("raw", [None, "", "   "])
     def test_rejects_missing_or_empty_value(self, sync, raw):
         with pytest.raises(RuntimeError, match="missing or empty"):
             sync["parse_github_token"](raw)
 
-    def test_rejects_invalid_json(self, sync):
-        with pytest.raises(RuntimeError, match="valid JSON"):
-            sync["parse_github_token"]("ghp_plain_token")
-
-    def test_rejects_json_that_is_not_an_object(self, sync):
-        with pytest.raises(RuntimeError, match="JSON object"):
-            sync["parse_github_token"]('["x"]')
-
-    @pytest.mark.parametrize("value", [{}, {"GITHUB_PAT": ""}, {"GITHUB_PAT": 5}])
-    def test_rejects_missing_or_invalid_pat(self, sync, value):
-        with pytest.raises(RuntimeError, match="GITHUB_PAT"):
-            sync["parse_github_token"](json.dumps(value))
-
 
 class TestGiteaToken:
-    def test_accepts_bare_token(self, sync):
+    def test_returns_the_stripped_token(self, sync):
-        assert sync["parse_gitea_token"]("abc123") == "abc123"
+        assert sync["parse_gitea_token"]("  abc123\n") == "abc123"
-
-    def test_accepts_json_object(self, sync):
-        assert sync["parse_gitea_token"]('{"GITEA_TOKEN": " t "}') == "t"
-
-    def test_accepts_json_string(self, sync):
-        assert sync["parse_gitea_token"]('"quoted"') == "quoted"
 
     @pytest.mark.parametrize("raw", [None, "", "  "])
     def test_rejects_missing_or_empty_value(self, sync, raw):
         with pytest.raises(RuntimeError, match="missing or empty"):
             sync["parse_gitea_token"](raw)
 
-    @pytest.mark.parametrize("raw", ["{}", '{"GITEA_TOKEN": ""}', "12", "[]"])
-    def test_rejects_value_without_token(self, sync, raw):
-        with pytest.raises(RuntimeError, match="GITEA_TOKEN"):
-            sync["parse_gitea_token"](raw)
-
 
 class TestSplitRepository:
     def test_splits_owner_and_repo(self, sync):
@@ -199,7 +178,7 @@ def environment(monkeypatch):
     monkeypatch.setenv("GITEA_API_URL", "https://git.example.test/api/v1/")
     monkeypatch.setenv("GITEA_CREDENTIALS", "gitea-token")
     monkeypatch.setenv("SOURCE_REPOSITORY", "TirSystem/repo")
-    monkeypatch.setenv("GITHUB_CREDENTIALS", json.dumps({"GITHUB_PAT": "gh-token"}))
+    monkeypatch.setenv("PAT_FOR_GITHUB", "gh-token")
 
 
 class TestMain:
@@ -258,7 +237,7 @@ class TestMain:
     def test_succeeds_without_changes_when_no_github_mirror_exists(
         self, sync, environment, monkeypatch, capsys, mirrors
     ):
-        monkeypatch.setenv("GITHUB_CREDENTIALS", "")
+        monkeypatch.setenv("PAT_FOR_GITHUB", "")
         api = FakeApi(mirrors)
         sync["request_json"] = api
 
@@ -271,11 +250,11 @@ class TestMain:
     def test_fails_before_any_change_when_github_credentials_are_missing(
         self, sync, environment, monkeypatch
     ):
-        monkeypatch.setenv("GITHUB_CREDENTIALS", "")
+        monkeypatch.setenv("PAT_FOR_GITHUB", "")
         api = FakeApi([{"remote_address": "git@github.com:Org/repo.git"}])
         sync["request_json"] = api
 
-        with pytest.raises(RuntimeError, match="CREDENTIALS_FOR_GITHUB"):
+        with pytest.raises(RuntimeError, match="PAT_FOR_GITHUB"):
             sync["main"]()
         assert all(call[0] == "GET" for call in api.calls)
 

tools/publish_wiki.py

@@ -7,7 +7,7 @@ source; edits made in the web UI are overwritten (MIL-005).
 Environment:
     GITEA_API_URL        Gitea API base, for example https://host/api/v1
     SOURCE_REPOSITORY    owner/repo of the repository whose wiki is written
-    WIKI_CREDENTIALS     bare token, JSON string, or JSON with GITEA_TOKEN
+    WIKI_CREDENTIALS     the Gitea token, as clear text
     WIKI_DIR             directory with the pages (default: wiki)
 
 Exit codes: 0 published or nothing to do, 1 failed (message names a category).
@@ -83,33 +83,15 @@ def request_json(
         raise WorkflowError("api", f"Gitea API is unreachable ({error}).") from None
 
 
-def parse_gitea_token(raw_credentials: str | None) -> str:
+def parse_gitea_token(raw_token: str | None) -> str:
-    """Return the token from a bare value, a JSON string or JSON with GITEA_TOKEN."""
+    """Return the token, or fail when the secret is missing or empty."""
-    raw_credentials = (raw_credentials or "").strip()
+    token = (raw_token or "").strip()
-    if not raw_credentials:
+    if not token:
         raise WorkflowError(
             "configuration",
             "No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.",
         )
-
+    return token
-    token: Any
-    try:
-        credentials = json.loads(raw_credentials)
-    except json.JSONDecodeError:
-        token = raw_credentials
-    else:
-        if isinstance(credentials, dict):
-            token = credentials.get("GITEA_TOKEN")
-        elif isinstance(credentials, str):
-            token = credentials
-        else:
-            token = None
-
-    if not isinstance(token, str) or not token.strip():
-        raise WorkflowError(
-            "configuration", "The wiki token must contain a non-empty GITEA_TOKEN."
-        )
-    return token.strip()
 
 
 def describe_token(token: str) -> str:

wiki/Capabilities.da.md

@@ -1,4 +1,4 @@
-<!-- translation of Capabilities.md, source sha256 468c912e521b -->
+<!-- translation of Capabilities.md, source sha256 5856fdc70a30 -->
 
 > Dette er en oversættelse af [`Capabilities`](Capabilities). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
 
@@ -43,7 +43,7 @@ activate Workflow
 Workflow -> Workflow: Read and validate secrets
 note right
 TOKEN_FOR_GITEA
-CREDENTIALS_FOR_GITHUB
+PAT_FOR_GITHUB
 end note
 
 alt secret validation failed

wiki/Capabilities.md

@@ -43,7 +43,7 @@ activate Workflow
 Workflow -> Workflow: Read and validate secrets
 note right
 TOKEN_FOR_GITEA
-CREDENTIALS_FOR_GITHUB
+PAT_FOR_GITHUB
 end note
 
 alt secret validation failed

wiki/Capabilities.ms.md

@@ -1,4 +1,4 @@
-<!-- translation of Capabilities.md, source sha256 468c912e521b -->
+<!-- translation of Capabilities.md, source sha256 5856fdc70a30 -->
 
 > Ini ialah terjemahan [`Capabilities`](Capabilities). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
 
@@ -43,7 +43,7 @@ activate Workflow
 Workflow -> Workflow: Read and validate secrets
 note right
 TOKEN_FOR_GITEA
-CREDENTIALS_FOR_GITHUB
+PAT_FOR_GITHUB
 end note
 
 alt secret validation failed

wiki/Credentials.da.md

@@ -1,4 +1,4 @@
-<!-- translation of Credentials.md, source sha256 57f66acfdc0a -->
+<!-- translation of Credentials.md, source sha256 b810a21a07d5 -->
 
 > Dette er en oversættelse af [`Credentials`](Credentials). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
 
@@ -10,8 +10,8 @@ Synkroniseringsworkflowet bruger to secrets. Giv hver af dem de mindste rettighe
 
 | Secret | Indhold | Bruges til |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA` | Et almindeligt token, en JSON-streng eller JSON med `GITEA_TOKEN` | At læse repositoryet (beskrivelse, emner) og dets push-spejle |
+| `TOKEN_FOR_GITEA` | Gitea-tokenet, intet andet | At læse repositoryet (beskrivelse, emner) og dets push-spejle |
-| `CREDENTIALS_FOR_GITHUB` | JSON-objekt med et `GITHUB_PAT`, der ikke er tomt | At ændre beskrivelse og emner på GitHub-spejlet |
+| `PAT_FOR_GITHUB` | GitHub-tokenet, intet andet | At ændre beskrivelse og emner på GitHub-spejlet |
 
 ## Mindste rettigheder
 
@@ -33,11 +33,7 @@ Kald, der foretages: `GET /repos/{owner}/{repo}` og `GET /repos/{owner}/{repo}/p
 
 Kald, der foretages: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (beskrivelse) og `PUT /repos/{owner}/{repo}/topics`.
 
-Format for `CREDENTIALS_FOR_GITHUB`:
+Format for `PAT_FOR_GITHUB`: kun token-strengen (fx `github_pat_...`) som almindelig tekst. Workflowet tjekker kun, at den ikke er tom; GitHub afviser en forkert værdi (HTTP 401).
-
-```json
-{"GITHUB_PAT": "<token>"}
-```
 
 ## Hvad workflowet kontrollerer, før det ændrer noget
 
@@ -56,7 +52,7 @@ Workflowet **Publish wiki** (kun dette repository) kopierer `wiki/` til Gitea-wi
 
 | Secret | Indhold | Bruges til |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA_WIKI` (valgfri) | Et almindeligt token, en JSON-streng eller JSON med `GITEA_TOKEN` | At skrive wikisiderne for dette repository |
+| `TOKEN_FOR_GITEA_WIKI` (valgfri) | Gitea-tokenet, intet andet | At skrive wikisiderne for dette repository |
 
 - Det token, der bruges, skal have scope `write:repository`, og dets bruger skal have skriveadgang til dette repository. Gitea har intet scope kun til wikien.
 - `TOKEN_FOR_GITEA` er beskrevet ovenfor med kun `read:repository`. Hvis det genbruges til wikien, skal dets scope hæves, hvilket også giver metadatasynkroniseringen skriveadgang. En separat `TOKEN_FOR_GITEA_WIKI` til en dedikeret bruger holder synkroniseringstokenet skrivebeskyttet. S05 beslutter hvilket, og S03 gemmer secreten.

wiki/Credentials.md

@@ -12,8 +12,8 @@ leaves.
 
 | Secret | Content | Used for |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA` | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Reading the repository (description, topics) and its push mirrors |
+| `TOKEN_FOR_GITEA` | The Gitea token, nothing else | Reading the repository (description, topics) and its push mirrors |
-| `CREDENTIALS_FOR_GITHUB` | JSON object with a non-empty `GITHUB_PAT` | Changing the description and topics of the GitHub mirror |
+| `PAT_FOR_GITHUB` | The GitHub token, nothing else | Changing the description and topics of the GitHub mirror |
 
 ## Minimum permissions
 
@@ -40,11 +40,9 @@ Calls made: `GET /repos/{owner}/{repo}` and `GET /repos/{owner}/{repo}/push_mirr
 Calls made: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (description)
 and `PUT /repos/{owner}/{repo}/topics`.
 
-Format of `CREDENTIALS_FOR_GITHUB`:
+Format of `PAT_FOR_GITHUB`: only the token string (for example
-
+`github_pat_...`), as clear text. The workflow only checks that it is not empty;
-```json
+GitHub rejects a wrong value (HTTP 401).
-{"GITHUB_PAT": "<token>"}
-```
 
 ## What the workflow checks before it changes anything
 
@@ -70,7 +68,7 @@ when that secret exists and otherwise reuses `TOKEN_FOR_GITEA`.
 
 | Secret | Content | Used for |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA_WIKI` (optional) | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Writing the wiki pages of this repository |
+| `TOKEN_FOR_GITEA_WIKI` (optional) | The Gitea token, nothing else | Writing the wiki pages of this repository |
 
 - The token that is used needs scope `write:repository`, and its user needs
   write access to this repository. Gitea has no wiki-only scope.

wiki/Credentials.ms.md

@@ -1,4 +1,4 @@
-<!-- translation of Credentials.md, source sha256 57f66acfdc0a -->
+<!-- translation of Credentials.md, source sha256 b810a21a07d5 -->
 
 > Ini ialah terjemahan [`Credentials`](Credentials). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
 
@@ -10,8 +10,8 @@ Aliran kerja penyegerakan menggunakan dua rahsia (secret). Beri setiap satu keis
 
 | Secret | Kandungan | Digunakan untuk |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA` | Token biasa, rentetan JSON, atau JSON dengan `GITEA_TOKEN` | Membaca repositori (penerangan, topik) dan push mirror-nya |
+| `TOKEN_FOR_GITEA` | Token Gitea, tiada yang lain | Membaca repositori (penerangan, topik) dan push mirror-nya |
-| `CREDENTIALS_FOR_GITHUB` | Objek JSON dengan `GITHUB_PAT` yang tidak kosong | Mengubah penerangan dan topik cermin GitHub |
+| `PAT_FOR_GITHUB` | Token GitHub, tiada yang lain | Mengubah penerangan dan topik cermin GitHub |
 
 ## Kebenaran minimum
 
@@ -33,11 +33,7 @@ Panggilan yang dibuat: `GET /repos/{owner}/{repo}` dan `GET /repos/{owner}/{repo
 
 Panggilan yang dibuat: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (penerangan) dan `PUT /repos/{owner}/{repo}/topics`.
 
-Format `CREDENTIALS_FOR_GITHUB`:
+Format `PAT_FOR_GITHUB`: hanya rentetan token (contohnya `github_pat_...`) sebagai teks biasa. Aliran kerja hanya menyemak bahawa ia tidak kosong; GitHub menolak nilai yang salah (HTTP 401).
-
-```json
-{"GITHUB_PAT": "<token>"}
-```
 
 ## Perkara yang disemak oleh aliran kerja sebelum mengubah apa-apa
 
@@ -56,7 +52,7 @@ Aliran kerja **Publish wiki** (repositori ini sahaja) menyalin `wiki/` ke wiki G
 
 | Secret | Kandungan | Digunakan untuk |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA_WIKI` (pilihan) | Token biasa, rentetan JSON, atau JSON dengan `GITEA_TOKEN` | Menulis halaman wiki repositori ini |
+| `TOKEN_FOR_GITEA_WIKI` (pilihan) | Token Gitea, tiada yang lain | Menulis halaman wiki repositori ini |
 
 - Token yang digunakan mesti mempunyai skop `write:repository`, dan penggunanya mesti mempunyai akses tulis kepada repositori ini. Gitea tidak mempunyai skop untuk wiki sahaja.
 - `TOKEN_FOR_GITEA` didokumenkan di atas dengan `read:repository` sahaja. Menggunakannya semula untuk wiki bermakna meningkatkan skopnya, yang juga memberi akses tulis kepada penyegerakan metadata. `TOKEN_FOR_GITEA_WIKI` yang berasingan untuk pengguna khusus mengekalkan token penyegerakan sebagai baca sahaja. S05 memutuskan yang mana, dan S03 menyimpan secret.

wiki/Home.da.md

@@ -1,4 +1,4 @@
-<!-- translation of Home.md, source sha256 75c6a7722bf7 -->
+<!-- translation of Home.md, source sha256 59273bf92278 -->
 
 > Dette er en oversættelse af [`Home`](Home). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
 
@@ -21,8 +21,8 @@ Det indeholder i øjeblikket Gitea-workflowet [`sync-github-metadata.yml`](https
 - En Gitea-instans med Actions aktiveret og en runner med labelen `ubuntu-latest` og `python3`
 - Et konfigureret GitHub push-spejl på Gitea-repositoryet (højst ét; repositories uden spejl springes over uden fejl)
 - Repository-secrets:
-  - `TOKEN_FOR_GITEA`: Gitea API-token (almindelig tekststreng eller JSON med `GITEA_TOKEN`)
+  - `TOKEN_FOR_GITEA`: Gitea API-token (kun tokenet, ingen JSON)
-  - `CREDENTIALS_FOR_GITHUB`: JSON-objekt med `GITHUB_PAT`, et GitHub personal access token, der må redigere spejl-repositoryet
+  - `PAT_FOR_GITHUB`: et GitHub personal access token, der må redigere spejl-repositoryet (kun tokenet, ingen JSON)
   - `TOKEN_FOR_GITEA_WIKI` (valgfri, kun i dette repository, til workflowet **Publish wiki**): Gitea-token, der kan skrive til repositoryets wiki; hvis den mangler, bruges `TOKEN_FOR_GITEA`, som så skal have skriveadgang
 
 

wiki/Home.md

@@ -21,8 +21,8 @@ It currently contains the Gitea workflow [`sync-github-metadata.yml`](https://gi
 - A Gitea instance with Actions enabled and a runner providing `ubuntu-latest` with `python3`
 - A configured GitHub push mirror on the Gitea repository (at most one; repositories without a mirror are skipped successfully)
 - Repository secrets:
-  - `TOKEN_FOR_GITEA`: Gitea API token (plain string, or JSON with `GITEA_TOKEN`)
+  - `TOKEN_FOR_GITEA`: Gitea API token (the token only, no JSON)
-  - `CREDENTIALS_FOR_GITHUB`: JSON object containing `GITHUB_PAT`, a GitHub personal access token allowed to edit the mirror repository
+  - `PAT_FOR_GITHUB`: a GitHub personal access token allowed to edit the mirror repository (the token only, no JSON)
   - `TOKEN_FOR_GITEA_WIKI` (optional, only in this repository, for the **Publish wiki** workflow): Gitea token that can write the repository wiki; when it is absent, `TOKEN_FOR_GITEA` is used and needs write access
 
 

wiki/Home.ms.md

@@ -1,4 +1,4 @@
-<!-- translation of Home.md, source sha256 75c6a7722bf7 -->
+<!-- translation of Home.md, source sha256 59273bf92278 -->
 
 > Ini ialah terjemahan [`Home`](Home). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
 
@@ -21,8 +21,8 @@ Buat masa ini ia mengandungi aliran kerja Gitea [`sync-github-metadata.yml`](htt
 - Satu instans Gitea dengan Actions diaktifkan dan satu runner yang menyediakan `ubuntu-latest` dengan `python3`
 - Satu push mirror GitHub yang dikonfigurasi pada repositori Gitea (paling banyak satu; repositori tanpa cermin dilangkau dengan jayanya)
 - Rahsia (secret) repositori:
-  - `TOKEN_FOR_GITEA`: token API Gitea (rentetan biasa, atau JSON dengan `GITEA_TOKEN`)
+  - `TOKEN_FOR_GITEA`: token API Gitea (token sahaja, tanpa JSON)
-  - `CREDENTIALS_FOR_GITHUB`: objek JSON yang mengandungi `GITHUB_PAT`, iaitu personal access token GitHub yang dibenarkan mengubah suai repositori cermin
+  - `PAT_FOR_GITHUB`: personal access token GitHub yang dibenarkan mengubah suai repositori cermin (token sahaja, tanpa JSON)
   - `TOKEN_FOR_GITEA_WIKI` (pilihan, hanya dalam repositori ini, untuk aliran kerja **Publish wiki**): token Gitea yang boleh menulis ke wiki repositori; jika tiada, `TOKEN_FOR_GITEA` digunakan dan mesti mempunyai akses tulis
 
 

wiki/Onboarding.da.md

@@ -1,4 +1,4 @@
-<!-- translation of Onboarding.md, source sha256 044127b33c19 -->
+<!-- translation of Onboarding.md, source sha256 8e755cad4918 -->
 
 > Dette er en oversættelse af [`Onboarding`](Onboarding). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
 
@@ -24,7 +24,7 @@ Indtil leveringen er verificeret, tilsluttes et repository ved at kopiere workfl
 2. **Konfigurer ét GitHub push-spejl** i repositoryets indstillinger (Settings, Repository, Mirror settings, Push mirror). Workflowet fejler, hvis der er flere GitHub-spejle. Hvis der ingen er, lykkes det uden at synkronisere noget.
 3. **Tilføj de to secrets** i repositoryets (eller organisationens) indstillinger med de scopes, der står i [credentials.md](Credentials.da):
    - `TOKEN_FOR_GITEA`
-   - `CREDENTIALS_FOR_GITHUB` (JSON med `GITHUB_PAT`)
+   - `PAT_FOR_GITHUB` (kun GitHub-tokenet)
 4. **Lever workflowet:**
    - *Hvis scoped workflows gælder for repositoryet:* der er intet at kopiere.
    - *Ellers:* kopier `.gitea/scoped_workflows/sync-github-metadata.yml` fra dette repository til `.gitea/workflows/` i mål-repositoryet. Fastlås kopien til en gennemgået version af dette repository, og kopier igen, når den ændres.

wiki/Onboarding.md

@@ -33,7 +33,7 @@ Until delivery is verified, onboard a repository by copying the workflow (below)
 3. **Add the two secrets** in the repository (or organization) settings,
    using the scopes in [credentials.md](Credentials):
    - `TOKEN_FOR_GITEA`
-   - `CREDENTIALS_FOR_GITHUB` (JSON with `GITHUB_PAT`)
+   - `PAT_FOR_GITHUB` (the GitHub token only)
 4. **Deliver the workflow:**
    - *If scoped workflows apply to the repository:* nothing to copy.
    - *Otherwise:* copy `.gitea/scoped_workflows/sync-github-metadata.yml`

wiki/Onboarding.ms.md

@@ -1,4 +1,4 @@
-<!-- translation of Onboarding.md, source sha256 044127b33c19 -->
+<!-- translation of Onboarding.md, source sha256 8e755cad4918 -->
 
 > Ini ialah terjemahan [`Onboarding`](Onboarding). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
 
@@ -24,7 +24,7 @@ Selagi penghantaran belum disahkan, sertakan repositori dengan menyalin aliran k
 2. **Konfigurasikan satu push mirror GitHub** dalam tetapan repositori (Settings, Repository, Mirror settings, Push mirror). Aliran kerja gagal jika terdapat beberapa cermin GitHub. Jika tiada, ia berjaya tanpa menyegerakkan apa-apa.
 3. **Tambah dua rahsia (secret)** dalam tetapan repositori (atau organisasi), dengan skop yang tertera dalam [credentials.md](Credentials.ms):
    - `TOKEN_FOR_GITEA`
-   - `CREDENTIALS_FOR_GITHUB` (JSON dengan `GITHUB_PAT`)
+   - `PAT_FOR_GITHUB` (token GitHub sahaja)
 4. **Hantar aliran kerja:**
    - *Jika scoped workflow terpakai pada repositori:* tiada apa yang perlu disalin.
    - *Jika tidak:* salin `.gitea/scoped_workflows/sync-github-metadata.yml` dari repositori ini ke `.gitea/workflows/` dalam repositori sasaran. Sematkan salinan itu pada versi repositori ini yang telah disemak, dan salin semula apabila ia berubah.

wiki/Troubleshooting.da.md

@@ -1,4 +1,4 @@
-<!-- translation of Troubleshooting.md, source sha256 d34495c26923 -->
+<!-- translation of Troubleshooting.md, source sha256 12672b3dde45 -->
 
 > Dette er en oversættelse af [`Troubleshooting`](Troubleshooting). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
 
@@ -26,12 +26,8 @@ Kategorien fortæller, hvor du skal kigge. En fejl uden for scriptet (jobbet sta
 
 | Meddelelse (begyndelsen) | Kategori | Årsag og løsning |
 | --- | --- | --- |
-| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Tilføj secreten |
+| `PAT_FOR_GITHUB is missing or empty.` | configuration | Tilføj secreten |
-| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | Værdien skal være JSON, fx `{"GITHUB_PAT": "..."}` |
-| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Brug et objekt, ikke en liste eller en streng |
-| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Tilføj nøglen `GITHUB_PAT` med et token |
 | `TOKEN_FOR_GITEA is missing or empty.` | configuration | Tilføj secreten |
-| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | JSON-formen kræver nøglen `GITEA_TOKEN` |
 | `Could not determine the Gitea source repository.` | configuration | Kørslen har intet repositorynavn; meld det som en defekt |
 | `Expected at most one GitHub push mirror ... found N` | configuration | Behold ét GitHub push-spejl |
 | `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Kun wiki-publicering: tilføj en af secrets (se [credentials.md](Credentials.da)) |
@@ -40,7 +36,7 @@ Kategorien fortæller, hvor du skal kigge. En fejl uden for scriptet (jobbet sta
 | `The wiki source directory ... has no Markdown pages` | configuration | Kun wiki-publicering: `wiki/` er tom eller mangler; intet blev ændret |
 | `Could not determine the GitHub owner and repository ...` | configuration | Spejlets adresse skal se ud som `https://github.com/<owner>/<repo>.git` |
 | `Gitea API request failed with HTTP 401` | credentials | Opret et nyt Gitea-token, og opdatér `TOKEN_FOR_GITEA` |
-| `GitHub API request failed with HTTP 401` | credentials | Opret et nyt GitHub-token, og opdatér `CREDENTIALS_FOR_GITHUB` |
+| `GitHub API request failed with HTTP 401` | credentials | Opret et nyt GitHub-token, og opdatér `PAT_FOR_GITHUB`; værdien skal kun være tokenet (intet navn, ingen anførselstegn eller JSON) |
 | `... HTTP 403 ...` (Gitea) | permissions | Tokenet skal have `read:repository`, og dets bruger skal være administrator af repositoryet |
 | `... HTTP 403 ...` (GitHub) | permissions | Tokenet skal have Administration read and write på spejl-repositoryet |
 | `The GitHub token cannot administer <repo>` | permissions | Som ovenfor; tokenet kan læse repositoryet, men ikke redigere det |

wiki/Troubleshooting.md

@@ -28,12 +28,8 @@ never starts, or stops before the step) is a **runner** problem.
 
 | Message (start) | Category | Cause and fix |
 | --- | --- | --- |
-| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
+| `PAT_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
-| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | The value must be JSON such as `{"GITHUB_PAT": "..."}` |
-| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Use an object, not a list or string |
-| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Add the `GITHUB_PAT` key with a token |
 | `TOKEN_FOR_GITEA is missing or empty.` | configuration | Add the secret |
-| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | The JSON form needs a `GITEA_TOKEN` key |
 | `Could not determine the Gitea source repository.` | configuration | The run has no repository name; report as a defect |
 | `Expected at most one GitHub push mirror ... found N` | configuration | Keep one GitHub push mirror |
 | `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Wiki publishing only: add one of the secrets (see [credentials.md](Credentials)) |
@@ -42,7 +38,7 @@ never starts, or stops before the step) is a **runner** problem.
 | `The wiki source directory ... has no Markdown pages` | configuration | Wiki publishing only: `wiki/` is empty or missing; nothing was changed |
 | `Could not determine the GitHub owner and repository ...` | configuration | The mirror address must look like `https://github.com/<owner>/<repo>.git` |
 | `Gitea API request failed with HTTP 401` | credentials | Create a new Gitea token and update `TOKEN_FOR_GITEA` |
-| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `CREDENTIALS_FOR_GITHUB` |
+| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `PAT_FOR_GITHUB`; the value must be the token only (no name, quotes or JSON) |
 | `... HTTP 403 ...` (Gitea) | permissions | Token needs `read:repository`, and its user needs administrator access to the repository |
 | `... HTTP 403 ...` (GitHub) | permissions | Token needs Administration read and write on the mirror repository |
 | `The GitHub token cannot administer <repo>` | permissions | Same as above; the token can read the repository but not edit it |

wiki/Troubleshooting.ms.md

@@ -1,4 +1,4 @@
-<!-- translation of Troubleshooting.md, source sha256 d34495c26923 -->
+<!-- translation of Troubleshooting.md, source sha256 12672b3dde45 -->
 
 > Ini ialah terjemahan [`Troubleshooting`](Troubleshooting). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
 
@@ -26,12 +26,8 @@ Kategori menunjukkan di mana perlu dilihat. Kegagalan di luar skrip (kerja tidak
 
 | Mesej (permulaan) | Kategori | Punca dan pembetulan |
 | --- | --- | --- |
-| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Tambah secret |
+| `PAT_FOR_GITHUB is missing or empty.` | configuration | Tambah secret |
-| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | Nilai mesti JSON seperti `{"GITHUB_PAT": "..."}` |
-| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Gunakan objek, bukan senarai atau rentetan |
-| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Tambah kunci `GITHUB_PAT` dengan token |
 | `TOKEN_FOR_GITEA is missing or empty.` | configuration | Tambah secret |
-| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | Bentuk JSON memerlukan kunci `GITEA_TOKEN` |
 | `Could not determine the Gitea source repository.` | configuration | Larian tiada nama repositori; laporkan sebagai kecacatan |
 | `Expected at most one GitHub push mirror ... found N` | configuration | Kekalkan satu push mirror GitHub |
 | `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Penerbitan wiki sahaja: tambah salah satu secret (lihat [credentials.md](Credentials.ms)) |
@@ -40,7 +36,7 @@ Kategori menunjukkan di mana perlu dilihat. Kegagalan di luar skrip (kerja tidak
 | `The wiki source directory ... has no Markdown pages` | configuration | Penerbitan wiki sahaja: `wiki/` kosong atau tiada; tiada apa-apa diubah |
 | `Could not determine the GitHub owner and repository ...` | configuration | Alamat cermin mesti kelihatan seperti `https://github.com/<owner>/<repo>.git` |
 | `Gitea API request failed with HTTP 401` | credentials | Cipta token Gitea baharu dan kemas kini `TOKEN_FOR_GITEA` |
-| `GitHub API request failed with HTTP 401` | credentials | Cipta token GitHub baharu dan kemas kini `CREDENTIALS_FOR_GITHUB` |
+| `GitHub API request failed with HTTP 401` | credentials | Cipta token GitHub baharu dan kemas kini `PAT_FOR_GITHUB`; nilai mesti token sahaja (tiada nama, tanda petikan atau JSON) |
 | `... HTTP 403 ...` (Gitea) | permissions | Token memerlukan `read:repository`, dan penggunanya mesti pentadbir repositori |
 | `... HTTP 403 ...` (GitHub) | permissions | Token memerlukan Administration read and write pada repositori cermin |
 | `The GitHub token cannot administer <repo>` | permissions | Sama seperti di atas; token boleh membaca repositori tetapi tidak boleh mengeditnya |