Lets the Publish wiki workflow reuse TOKEN_FOR_GITEA, so no new secret is needed.
Changes
.gitea/workflows/publish-wiki.yml: WIKI_CREDENTIALS is secrets.TOKEN_FOR_GITEA_WIKI || secrets.TOKEN_FOR_GITEA. A separate wiki secret still wins if one is added.
tools/publish_wiki.py: the missing-token message is now "No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA."; the tests follow.
guides/credentials.md, guides/troubleshooting.md and README.md describe the fallback and the scope it needs.
Wiki pages changed (rule 8)
English: Home, Credentials, Troubleshooting. Danish and Bahasa Malaysia: Home, Credentials, Troubleshooting (retranslated, structure unchanged apart from one added troubleshooting row). Full suite: 137 passed.
Notes
Writing wiki pages needs write:repository and write access to this repository. TOKEN_FOR_GITEA is documented as read:repository; if it is read-only, the publish fails with a categorised [permissions] HTTP 403 and writes nothing.
Raising that token's scope also gives the metadata sync write access. A separate TOKEN_FOR_GITEA_WIKI for a dedicated user keeps the sync token read-only; S05 decides.
MIL-005 task 2 and ADR-0001 still describe a separate secret; amending them needs a version row and review, so they are unchanged.
The dispatch runs the workflow from main, so the fallback takes effect after this merges. Publishing and verifying (#38) follows.
Token shape in a 401 (second commit)
When Gitea rejects the wiki token, the error now ends with Token shape: N characters, ...: the length, whether it looks like a Gitea token (40 hexadecimal characters) and the likely storage mistake (only mask characters, NAME=value, quotes, whitespace). No character of the token is printed, and 403 and configuration errors are unchanged. Tests: 144 passed.
Lets the **Publish wiki** workflow reuse `TOKEN_FOR_GITEA`, so no new secret is needed.
## Changes
- `.gitea/workflows/publish-wiki.yml`: `WIKI_CREDENTIALS` is `secrets.TOKEN_FOR_GITEA_WIKI || secrets.TOKEN_FOR_GITEA`. A separate wiki secret still wins if one is added.
- `tools/publish_wiki.py`: the missing-token message is now "No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA."; the tests follow.
- `guides/credentials.md`, `guides/troubleshooting.md` and `README.md` describe the fallback and the scope it needs.
## Wiki pages changed (rule 8)
English: Home, Credentials, Troubleshooting. Danish and Bahasa Malaysia: Home, Credentials, Troubleshooting (retranslated, structure unchanged apart from one added troubleshooting row). Full suite: 137 passed.
## Notes
- Writing wiki pages needs `write:repository` and write access to this repository. `TOKEN_FOR_GITEA` is documented as `read:repository`; if it is read-only, the publish fails with a categorised `[permissions]` HTTP 403 and writes nothing.
- Raising that token's scope also gives the metadata sync write access. A separate `TOKEN_FOR_GITEA_WIKI` for a dedicated user keeps the sync token read-only; S05 decides.
- MIL-005 task 2 and ADR-0001 still describe a separate secret; amending them needs a version row and review, so they are unchanged.
- The dispatch runs the workflow from `main`, so the fallback takes effect after this merges. Publishing and verifying (#38) follows.
## Token shape in a 401 (second commit)
When Gitea rejects the wiki token, the error now ends with `Token shape: N characters, ...`: the length, whether it looks like a Gitea token (40 hexadecimal characters) and the likely storage mistake (only mask characters, `NAME=value`, quotes, whitespace). No character of the token is printed, and 403 and configuration errors are unchanged. Tests: 144 passed.
Refs #42
Refs #38
The Publish wiki workflow now reads secrets.TOKEN_FOR_GITEA_WIKI ||
secrets.TOKEN_FOR_GITEA, so the existing token can publish the wiki when it
has write:repository. Update the missing-token message, the credentials and
troubleshooting guides, the README, the tests and the affected English
wiki pages with their Danish and Bahasa Malaysia translations.
Task: MIL-005#8
When Gitea answers 401, add the token's length and likely storage mistakes
(masked text, NAME=value, quotes, whitespace) to the message, without any
character of the token, so a wrongly stored secret can be recognised from
the log.
Task: MIL-005#8
Tirsvad
merged commit 1a9c9a32e7 into main2026-10-10 04:05:12 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Lets the Publish wiki workflow reuse
TOKEN_FOR_GITEA, so no new secret is needed.Changes
.gitea/workflows/publish-wiki.yml:WIKI_CREDENTIALSissecrets.TOKEN_FOR_GITEA_WIKI || secrets.TOKEN_FOR_GITEA. A separate wiki secret still wins if one is added.tools/publish_wiki.py: the missing-token message is now "No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA."; the tests follow.guides/credentials.md,guides/troubleshooting.mdandREADME.mddescribe the fallback and the scope it needs.Wiki pages changed (rule 8)
English: Home, Credentials, Troubleshooting. Danish and Bahasa Malaysia: Home, Credentials, Troubleshooting (retranslated, structure unchanged apart from one added troubleshooting row). Full suite: 137 passed.
Notes
write:repositoryand write access to this repository.TOKEN_FOR_GITEAis documented asread:repository; if it is read-only, the publish fails with a categorised[permissions]HTTP 403 and writes nothing.TOKEN_FOR_GITEA_WIKIfor a dedicated user keeps the sync token read-only; S05 decides.main, so the fallback takes effect after this merges. Publishing and verifying (#38) follows.Token shape in a 401 (second commit)
When Gitea rejects the wiki token, the error now ends with
Token shape: N characters, ...: the length, whether it looks like a Gitea token (40 hexadecimal characters) and the likely storage mistake (only mask characters,NAME=value, quotes, whitespace). No character of the token is printed, and 403 and configuration errors are unchanged. Tests: 144 passed.Refs #42
Refs #38