S01, standing in for S05 (ADR-0002), approves the minimum Gitea and GitHub
token permissions, recorded with the evidence from the Gitea source and the
GitHub documentation; they are still not tested with a minimal token on the
instance. Confirm the target dates of MIL-001 to MIL-006 and PP-001 (RC-026
to RC-032), update TM-001 and regenerate the Credentials wiki page with its
translations.
Task: MIL-002#4
Describe the wiki/.publish marker and the prune word, the per-organisation
TOKEN_FOR_GITEA_WIKI without fallback, and the new messages in the
onboarding, credentials and troubleshooting guides and the README. Add the
capability row and regenerate the five English wiki pages with their Danish
and Bahasa Malaysia translations.
Task: MIL-006#5
The sync workflow reads secrets.PAT_FOR_GITHUB as clear text and
parse_github_token and parse_gitea_token only check that the value is not
empty. No secret is JSON any more; the wiki publisher follows. Update the
tests, the guides, the README, PP-001 UC candidate 2 and the wiki pages with
their Danish and Bahasa Malaysia translations.
Task: MIL-002#5
The Publish wiki workflow now reads secrets.TOKEN_FOR_GITEA_WIKI ||
secrets.TOKEN_FOR_GITEA, so the existing token can publish the wiki when it
has write:repository. Update the missing-token message, the credentials and
troubleshooting guides, the README, the tests and the affected English
wiki pages with their Danish and Bahasa Malaysia translations.
Task: MIL-005#8
Add tools/publish_wiki.py and the Publish wiki workflow, which make the
Gitea wiki equal wiki/ through the wiki REST API when a change to wiki/ is
merged to main. It needs its own secret TOKEN_FOR_GITEA_WIKI, refuses an
empty source and checks that the English pages are current first.
Document the secret in the credentials and troubleshooting guides and
regenerate the affected wiki pages.
Task: MIL-005#8
Not every Gitea repository has a GitHub push mirror. Zero GitHub mirrors
now ends the run successfully without reading the GitHub secret; several
mirrors still fail. Tests, guides, README, BC-001, PP-001 and MIL-001
are updated to match.
Task: MIL-001#1
Task: MIL-001#5
Sync workflow: every failure is now reported as `ERROR: [category] message`
with the categories configuration, credentials (HTTP 401), permissions
(HTTP 403) and api (other HTTP errors, unreachable service); HTTP 404 is a
configuration error. Before changing anything the workflow checks that the
GitHub token can administer the mirror repository and stops with a
permissions error otherwise. No secret value is printed.
Guides: onboarding (with runner labels, prerequisites and offline runner
symptoms), credentials (minimum permissions, preflight, rotation) and
troubleshooting (every message mapped to a category and a fix). README
capability table updated. MIL-002 records the verification of scoped
workflow support: Gitea 1.27.3 runs the workflow in this repository;
delivery to other repositories is not yet verified.
Task: MIL-002#2
Task: MIL-002#3
Task: MIL-002#4
Task: MIL-002#5
Task: MIL-002#6
Task: MIL-002#7
Refs #9
Refs #10
Refs #11
Refs #12
Refs #13
Refs #14
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Tirsvad
