diff --git a/.gitea/scoped_workflows/sync-github-metadata.yml b/.gitea/scoped_workflows/sync-github-metadata.yml index 6b23740..2971a99 100644 --- a/.gitea/scoped_workflows/sync-github-metadata.yml +++ b/.gitea/scoped_workflows/sync-github-metadata.yml @@ -18,7 +18,7 @@ jobs: GITEA_API_URL: ${{ gitea.api_url }} GITEA_CREDENTIALS: ${{ secrets.TOKEN_FOR_GITEA }} SOURCE_REPOSITORY: ${{ gitea.repository }} - GITHUB_CREDENTIALS: ${{ secrets.CREDENTIALS_FOR_GITHUB }} + PAT_FOR_GITHUB: ${{ secrets.PAT_FOR_GITHUB }} run: | python3 - <<'PY' import json @@ -87,61 +87,22 @@ jobs: ) from None - def parse_github_token(raw_credentials): - raw_credentials = (raw_credentials or "").strip() - if not raw_credentials: + def parse_github_token(raw_token): + token = (raw_token or "").strip() + if not token: raise WorkflowError( - "configuration", "CREDENTIALS_FOR_GITHUB is missing or empty." + "configuration", "PAT_FOR_GITHUB is missing or empty." ) - - try: - credentials = json.loads(raw_credentials) - except json.JSONDecodeError: - raise WorkflowError( - "configuration", - "CREDENTIALS_FOR_GITHUB must contain valid JSON.", - ) from None - - if not isinstance(credentials, dict): - raise WorkflowError( - "configuration", - "CREDENTIALS_FOR_GITHUB must be a JSON object.", - ) - - token = credentials.get("GITHUB_PAT") - if not isinstance(token, str) or not token.strip(): - raise WorkflowError( - "configuration", - "CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.", - ) - return token.strip() + return token - def parse_gitea_token(raw_credentials): - raw_credentials = (raw_credentials or "").strip() - if not raw_credentials: + def parse_gitea_token(raw_token): + token = (raw_token or "").strip() + if not token: raise WorkflowError( "configuration", "TOKEN_FOR_GITEA is missing or empty." ) - - try: - credentials = json.loads(raw_credentials) - except json.JSONDecodeError: - token = raw_credentials - else: - if isinstance(credentials, dict): - token = credentials.get("GITEA_TOKEN") - elif isinstance(credentials, str): - token = credentials - else: - token = None - - if not isinstance(token, str) or not token.strip(): - raise WorkflowError( - "configuration", - "TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.", - ) - return token.strip() + return token def split_repository(full_name): @@ -219,7 +180,7 @@ jobs: ) return 0 - github_token = parse_github_token(os.environ.get("GITHUB_CREDENTIALS")) + github_token = parse_github_token(os.environ.get("PAT_FOR_GITHUB")) github_owner, github_repo = target github_api_url = ( "https://api.github.com/repos/" diff --git a/README.md b/README.md index 68793c6..e8cb5cc 100644 --- a/README.md +++ b/README.md @@ -23,8 +23,8 @@ It currently contains the Gitea workflow [`sync-github-metadata.yml`](.gitea/sco - A Gitea instance with Actions enabled and a runner providing `ubuntu-latest` with `python3` - A configured GitHub push mirror on the Gitea repository (at most one; repositories without a mirror are skipped successfully) - Repository secrets: - - `TOKEN_FOR_GITEA`: Gitea API token (plain string, or JSON with `GITEA_TOKEN`) - - `CREDENTIALS_FOR_GITHUB`: JSON object containing `GITHUB_PAT`, a GitHub personal access token allowed to edit the mirror repository + - `TOKEN_FOR_GITEA`: Gitea API token (the token only, no JSON) + - `PAT_FOR_GITHUB`: a GitHub personal access token allowed to edit the mirror repository (the token only, no JSON) - `TOKEN_FOR_GITEA_WIKI` (optional, only in this repository, for the **Publish wiki** workflow): Gitea token that can write the repository wiki; when it is absent, `TOKEN_FOR_GITEA` is used and needs write access ## 🛠️ Setup @@ -96,7 +96,7 @@ activate Workflow Workflow -> Workflow: Read and validate secrets note right TOKEN_FOR_GITEA -CREDENTIALS_FOR_GITHUB +PAT_FOR_GITHUB end note alt secret validation failed diff --git a/docs/artifact-registry.md b/docs/artifact-registry.md index b633e5f..1b5d11a 100644 --- a/docs/artifact-registry.md +++ b/docs/artifact-registry.md @@ -11,7 +11,7 @@ each document lives in *this* project and the next version to use. | SA | Stakeholder Analysis | docs/stakeholder-analysis.md | 002 | | PP | Project Plan | docs/project-plan.md | 002 | | MIL | Milestone / Gateway | docs/milestones/*.md | 006 | -| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 015 | +| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 016 | | TM | Traceability Matrix | docs/sqa/traceability-matrix.md | 002 | | ADR | Architecture Decision Record | docs/adr/adr-NNNN-*.md | 0004 | diff --git a/docs/project-plan.md b/docs/project-plan.md index 116d966..0d479ef 100644 --- a/docs/project-plan.md +++ b/docs/project-plan.md @@ -9,8 +9,8 @@ ## Version History | Date | Status | Author | Reviewer | Change | Commit | | --- | --- | --- | --- | --- | --- | -| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Added gateway MIL-005 (wiki and translations) | [08ef26a] | -| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Last decision date is 2026-12-12 after adding MIL-005 | [ae4e257] | +| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | UC candidate 2 names the secret PAT_FOR_GITHUB | [a26a491] | +| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Reviewed (RC-015): JSON removed from the credential failures, answered MIL-001 decisions removed from Open Issues | [b282e10] | --- @@ -81,8 +81,6 @@ A No-Go moves every later window by the rework time of the failed milestone. ## Open Issues - Confirm the proposed dates and the start week (S01 and S05). -- Decide the behavior for an invalid push mirror response (MIL-001 task 1). -- Decide the canonical location of the workflow source (MIL-001 task 3). - No QC checklist exists for the Project Plan. - Formal use cases need a use case diagram and user stories first; neither exists yet. @@ -134,8 +132,8 @@ no tests, no release process. - **Trigger:** onboarding a repository or rotating a token. - **Preconditions:** access to Gitea and GitHub settings. - **Success:** a workflow run passes credential checks with the documented minimum permissions. -- **Main flow:** create the tokens, store `TOKEN_FOR_GITEA` and `CREDENTIALS_FOR_GITHUB`, run the workflow, read the validation result. -- **Alternatives and failures:** malformed JSON, empty value, expired token, missing permission: the check names the category without printing the secret. +- **Main flow:** create the tokens, store `TOKEN_FOR_GITEA` and `PAT_FOR_GITHUB`, run the workflow, read the validation result. +- **Alternatives and failures:** empty value, wrong or expired token (rejected with HTTP 401), missing permission: the check names the category without printing the secret. - **Dependencies:** use case 1. ### UC candidate 3: Onboard a repository to standard workflows (P1) @@ -252,5 +250,5 @@ no tests, no release process. [Milestone MIL-003]: https://git.tirsystem.com/TirSystem/github-action/milestone/20 [Milestone MIL-004]: https://git.tirsystem.com/TirSystem/github-action/milestone/21 [Milestone MIL-005]: https://git.tirsystem.com/TirSystem/github-action/milestone/93 -[08ef26a]: https://git.tirsystem.com/TirSystem/github-action/commit/08ef26a6d3eb98c066b45634c2271e578e6c0a0b -[ae4e257]: https://git.tirsystem.com/TirSystem/github-action/commit/ae4e257236095e76132980fad1e9a661b1d082c7 +[a26a491]: https://git.tirsystem.com/TirSystem/github-action/commit/a26a49173718b89785ea4a6e4c8bdbfb9aca975d +[b282e10]: https://git.tirsystem.com/TirSystem/github-action/commit/b282e107416a890d6df27e6bdf23ab8a65e17123 diff --git a/docs/sqa/reviews/rc-015-project-plan-pat.md b/docs/sqa/reviews/rc-015-project-plan-pat.md new file mode 100644 index 0000000..aff537f --- /dev/null +++ b/docs/sqa/reviews/rc-015-project-plan-pat.md @@ -0,0 +1,47 @@ +# Review Record: PP-001 Project Plan (PAT_FOR_GITHUB, open issues) + +## Metadata +| Key | Value | +| --- | --- | +| ID | RC-015 | +| CrossReference | [PP-001], [BC-001] | + +## Version History +| Date | Status | Author | Reviewer | Change | Commit | +| --- | --- | --- | --- | --- | --- | +| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version | [b282e10] | + +--- + +## Artifact Under Review + +- Instance reviewed: [PP-001] +- Checklist used: none: the Project Plan has no QC checklist. Validated against the Business Case [BC-001] and the Go / No-Go criteria of each listed milestone, as `PP.md` prescribes. + +## Checklist Results + +| # | Criterion | Status | Evidence/Notes | +| --- | --- | --- | --- | +| 1 | Every milestone in the plan has a `MIL-*` document and the plan's dates equal that document's target date | Pass | MIL-001 to MIL-005 exist; decision dates equal each Target Date. | +| 2 | Every Business Case scope item is covered by a gateway | Pass | Unchanged; Scope Coverage maps all items. | +| 3 | The schedule respects the Business Case constraints | Pass | The Business Case sets no deadline; dates are marked as proposals. | +| 4 | Dependencies between milestones are stated | Pass | Unchanged. | +| 5 | Every gateway has an owner who is a stakeholder ID | Pass | All five gateways are owned by S05. | +| 6 | Plan content is internally consistent | Pass | Finding fixed during this review: UC candidate 2 still listed "malformed JSON" as a credential failure although no secret is JSON any more. It now lists the empty value, a wrong or expired token (HTTP 401) and a missing permission. The secret names match the code and the guides. | +| 7 | Open Issues are current | Pass | Finding fixed during this review: the MIL-001 task 1 and task 3 decisions were made and are recorded in MIL-001, so they are removed. The remaining items are still open: confirm dates, no QC checklist for the Project Plan, formal use cases wait for a diagram and user stories. This closes the RC-009 action item. | + +## Overall Verdict + +Go - all seven criteria pass; the two findings were fixed during the review. S01 gave the Go in chat on 2026-10-10, standing in for the other reviewers as ADR-0002 records; there is no independent reader. + +## Action Items + +| Action | Owner | Due | +| --- | --- | --- | +| Confirm the proposed dates and the start week (already in Open Issues) | S01 | 2026-10-17 | + +--- + +[PP-001]: ../../project-plan.md +[BC-001]: ../../business-case.md +[b282e10]: https://git.tirsystem.com/TirSystem/github-action/commit/b282e107416a890d6df27e6bdf23ab8a65e17123 diff --git a/docs/sqa/traceability-matrix.md b/docs/sqa/traceability-matrix.md index 10019f0..793658f 100644 --- a/docs/sqa/traceability-matrix.md +++ b/docs/sqa/traceability-matrix.md @@ -4,13 +4,13 @@ | Key | Value | | --- | --- | | ID | TM-001 | -| CrossReference | [BC-001], [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005], [RC-001], [RC-002], [RC-003], [RC-004], [RC-005], [RC-006], [RC-007], [RC-008], [RC-009], [RC-010], [RC-011], [RC-012], [RC-013], [RC-014], [ADR-0001], [ADR-0002], [ADR-0003] | +| CrossReference | [BC-001], [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005], [RC-001], [RC-002], [RC-003], [RC-004], [RC-005], [RC-006], [RC-007], [RC-008], [RC-009], [RC-010], [RC-011], [RC-012], [RC-013], [RC-014], [RC-015], [ADR-0001], [ADR-0002], [ADR-0003] | ## Version History | Date | Status | Author | Reviewer | Change | Commit | | --- | --- | --- | --- | --- | --- | -| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Added ADR-0001 and RC-012 | [d0618d9] | -| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Added ADR-0002, ADR-0003 and RC-013, RC-014 | [bc3bd07] | +| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Added ADR-0002, ADR-0003 and RC-013, RC-014 | [bc3bd07] | +| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Added RC-015 for PP-001 | [b282e10] | --- @@ -26,7 +26,7 @@ updated whenever an artifact instance is created or reviewed. | --- | --- | --- | --- | --- | | [SA-001] | SA | - | [BC-001] | [RC-004] | | [BC-001] | BC | [SA-001] | [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005] | [RC-001], [RC-008] | -| [PP-001] | PP | [BC-001], [SA-001] | [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005] | [RC-002], [RC-009] | +| [PP-001] | PP | [BC-001], [SA-001] | [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005] | [RC-002], [RC-009], [RC-015] | | [MIL-001] | MIL | [BC-001], [PP-001] | [MIL-002] | [RC-003] | | [MIL-002] | MIL | [BC-001], [PP-001], [MIL-001] | [MIL-003], [MIL-005] | [RC-005] | | [MIL-003] | MIL | [BC-001], [PP-001], [MIL-002] | [MIL-004] | [RC-006] | @@ -49,6 +49,7 @@ updated whenever an artifact instance is created or reviewed. | [RC-012] | RC | [ADR-0001] | - | - | | [RC-013] | RC | [ADR-0002] | - | - | | [RC-014] | RC | [ADR-0003] | - | - | +| [RC-015] | RC | [PP-001] | - | - | ## Coverage Notes @@ -84,5 +85,6 @@ updated whenever an artifact instance is created or reviewed. [ADR-0003]: ../adr/adr-0003-wiki-publish-token.md [RC-013]: ./reviews/rc-013-adr-0002.md [RC-014]: ./reviews/rc-014-adr-0003.md -[d0618d9]: https://git.tirsystem.com/TirSystem/github-action/commit/d0618d929f2ec274d30b10bb1be306e1f04c31ee +[RC-015]: ./reviews/rc-015-project-plan-pat.md [bc3bd07]: https://git.tirsystem.com/TirSystem/github-action/commit/bc3bd07b29a0a3dcf45045b9baac64c36144c6d1 +[b282e10]: https://git.tirsystem.com/TirSystem/github-action/commit/b282e107416a890d6df27e6bdf23ab8a65e17123 diff --git a/guides/credentials.md b/guides/credentials.md index 978cf6a..7186009 100644 --- a/guides/credentials.md +++ b/guides/credentials.md @@ -6,8 +6,8 @@ leaves. | Secret | Content | Used for | | --- | --- | --- | -| `TOKEN_FOR_GITEA` | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Reading the repository (description, topics) and its push mirrors | -| `CREDENTIALS_FOR_GITHUB` | JSON object with a non-empty `GITHUB_PAT` | Changing the description and topics of the GitHub mirror | +| `TOKEN_FOR_GITEA` | The Gitea token, nothing else | Reading the repository (description, topics) and its push mirrors | +| `PAT_FOR_GITHUB` | The GitHub token, nothing else | Changing the description and topics of the GitHub mirror | ## Minimum permissions @@ -34,11 +34,9 @@ Calls made: `GET /repos/{owner}/{repo}` and `GET /repos/{owner}/{repo}/push_mirr Calls made: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (description) and `PUT /repos/{owner}/{repo}/topics`. -Format of `CREDENTIALS_FOR_GITHUB`: - -```json -{"GITHUB_PAT": ""} -``` +Format of `PAT_FOR_GITHUB`: only the token string (for example +`github_pat_...`), as clear text. The workflow only checks that it is not empty; +GitHub rejects a wrong value (HTTP 401). ## What the workflow checks before it changes anything @@ -64,7 +62,7 @@ when that secret exists and otherwise reuses `TOKEN_FOR_GITEA`. | Secret | Content | Used for | | --- | --- | --- | -| `TOKEN_FOR_GITEA_WIKI` (optional) | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Writing the wiki pages of this repository | +| `TOKEN_FOR_GITEA_WIKI` (optional) | The Gitea token, nothing else | Writing the wiki pages of this repository | - The token that is used needs scope `write:repository`, and its user needs write access to this repository. Gitea has no wiki-only scope. diff --git a/guides/onboarding.md b/guides/onboarding.md index 5fca182..be2f8b6 100644 --- a/guides/onboarding.md +++ b/guides/onboarding.md @@ -27,7 +27,7 @@ Until delivery is verified, onboard a repository by copying the workflow (below) 3. **Add the two secrets** in the repository (or organization) settings, using the scopes in [credentials.md](credentials.md): - `TOKEN_FOR_GITEA` - - `CREDENTIALS_FOR_GITHUB` (JSON with `GITHUB_PAT`) + - `PAT_FOR_GITHUB` (the GitHub token only) 4. **Deliver the workflow:** - *If scoped workflows apply to the repository:* nothing to copy. - *Otherwise:* copy `.gitea/scoped_workflows/sync-github-metadata.yml` diff --git a/guides/troubleshooting.md b/guides/troubleshooting.md index 00476b6..4a1f082 100644 --- a/guides/troubleshooting.md +++ b/guides/troubleshooting.md @@ -22,12 +22,8 @@ never starts, or stops before the step) is a **runner** problem. | Message (start) | Category | Cause and fix | | --- | --- | --- | -| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Add the secret | -| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | The value must be JSON such as `{"GITHUB_PAT": "..."}` | -| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Use an object, not a list or string | -| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Add the `GITHUB_PAT` key with a token | +| `PAT_FOR_GITHUB is missing or empty.` | configuration | Add the secret | | `TOKEN_FOR_GITEA is missing or empty.` | configuration | Add the secret | -| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | The JSON form needs a `GITEA_TOKEN` key | | `Could not determine the Gitea source repository.` | configuration | The run has no repository name; report as a defect | | `Expected at most one GitHub push mirror ... found N` | configuration | Keep one GitHub push mirror | | `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Wiki publishing only: add one of the secrets (see [credentials.md](credentials.md)) | @@ -36,7 +32,7 @@ never starts, or stops before the step) is a **runner** problem. | `The wiki source directory ... has no Markdown pages` | configuration | Wiki publishing only: `wiki/` is empty or missing; nothing was changed | | `Could not determine the GitHub owner and repository ...` | configuration | The mirror address must look like `https://github.com//.git` | | `Gitea API request failed with HTTP 401` | credentials | Create a new Gitea token and update `TOKEN_FOR_GITEA` | -| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `CREDENTIALS_FOR_GITHUB` | +| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `PAT_FOR_GITHUB`; the value must be the token only (no name, quotes or JSON) | | `... HTTP 403 ...` (Gitea) | permissions | Token needs `read:repository`, and its user needs administrator access to the repository | | `... HTTP 403 ...` (GitHub) | permissions | Token needs Administration read and write on the mirror repository | | `The GitHub token cannot administer ` | permissions | Same as above; the token can read the repository but not edit it | diff --git a/tests/test_publish_wiki.py b/tests/test_publish_wiki.py index 3b63d19..559d8be 100644 --- a/tests/test_publish_wiki.py +++ b/tests/test_publish_wiki.py @@ -29,19 +29,15 @@ def b64(text: str) -> str: class TestParseGiteaToken: - def test_accepts_bare_token(self): - assert publish_wiki.parse_gitea_token(" abc ") == "abc" + def test_returns_the_stripped_token(self): + assert publish_wiki.parse_gitea_token(" abc \n") == "abc" - def test_accepts_json_object_and_string(self): - assert publish_wiki.parse_gitea_token('{"GITEA_TOKEN": "abc"}') == "abc" - assert publish_wiki.parse_gitea_token('"abc"') == "abc" - - @pytest.mark.parametrize("raw", [None, "", " ", "{}", '{"GITEA_TOKEN": ""}', "[1]"]) + @pytest.mark.parametrize("raw", [None, "", " "]) def test_rejects_missing_or_empty_token(self, raw): with pytest.raises(publish_wiki.WorkflowError) as caught: publish_wiki.parse_gitea_token(raw) assert caught.value.category == "configuration" - assert "TOKEN_FOR_GITEA" in str(caught.value) or "wiki token" in str(caught.value) + assert "No token for the wiki" in str(caught.value) class TestReadPages: diff --git a/tests/test_sync_github_metadata.py b/tests/test_sync_github_metadata.py index 5ff7d09..b1716d3 100644 --- a/tests/test_sync_github_metadata.py +++ b/tests/test_sync_github_metadata.py @@ -15,49 +15,28 @@ def sync(): class TestGithubToken: - def test_returns_stripped_token_from_json_object(self, sync): - raw = json.dumps({"GITHUB_PAT": " ghp_abc "}) - assert sync["parse_github_token"](raw) == "ghp_abc" + def test_returns_the_stripped_token(self, sync): + assert sync["parse_github_token"](" ghp_abc\n") == "ghp_abc" + + def test_accepts_a_fine_grained_token(self, sync): + token = "github_pat_11ABCDEFG0abcdefghijkl_mnopqrstuvwxyz0123456789" + assert sync["parse_github_token"](token) == token @pytest.mark.parametrize("raw", [None, "", " "]) def test_rejects_missing_or_empty_value(self, sync, raw): with pytest.raises(RuntimeError, match="missing or empty"): sync["parse_github_token"](raw) - def test_rejects_invalid_json(self, sync): - with pytest.raises(RuntimeError, match="valid JSON"): - sync["parse_github_token"]("ghp_plain_token") - - def test_rejects_json_that_is_not_an_object(self, sync): - with pytest.raises(RuntimeError, match="JSON object"): - sync["parse_github_token"]('["x"]') - - @pytest.mark.parametrize("value", [{}, {"GITHUB_PAT": ""}, {"GITHUB_PAT": 5}]) - def test_rejects_missing_or_invalid_pat(self, sync, value): - with pytest.raises(RuntimeError, match="GITHUB_PAT"): - sync["parse_github_token"](json.dumps(value)) - class TestGiteaToken: - def test_accepts_bare_token(self, sync): - assert sync["parse_gitea_token"]("abc123") == "abc123" - - def test_accepts_json_object(self, sync): - assert sync["parse_gitea_token"]('{"GITEA_TOKEN": " t "}') == "t" - - def test_accepts_json_string(self, sync): - assert sync["parse_gitea_token"]('"quoted"') == "quoted" + def test_returns_the_stripped_token(self, sync): + assert sync["parse_gitea_token"](" abc123\n") == "abc123" @pytest.mark.parametrize("raw", [None, "", " "]) def test_rejects_missing_or_empty_value(self, sync, raw): with pytest.raises(RuntimeError, match="missing or empty"): sync["parse_gitea_token"](raw) - @pytest.mark.parametrize("raw", ["{}", '{"GITEA_TOKEN": ""}', "12", "[]"]) - def test_rejects_value_without_token(self, sync, raw): - with pytest.raises(RuntimeError, match="GITEA_TOKEN"): - sync["parse_gitea_token"](raw) - class TestSplitRepository: def test_splits_owner_and_repo(self, sync): @@ -199,7 +178,7 @@ def environment(monkeypatch): monkeypatch.setenv("GITEA_API_URL", "https://git.example.test/api/v1/") monkeypatch.setenv("GITEA_CREDENTIALS", "gitea-token") monkeypatch.setenv("SOURCE_REPOSITORY", "TirSystem/repo") - monkeypatch.setenv("GITHUB_CREDENTIALS", json.dumps({"GITHUB_PAT": "gh-token"})) + monkeypatch.setenv("PAT_FOR_GITHUB", "gh-token") class TestMain: @@ -258,7 +237,7 @@ class TestMain: def test_succeeds_without_changes_when_no_github_mirror_exists( self, sync, environment, monkeypatch, capsys, mirrors ): - monkeypatch.setenv("GITHUB_CREDENTIALS", "") + monkeypatch.setenv("PAT_FOR_GITHUB", "") api = FakeApi(mirrors) sync["request_json"] = api @@ -271,11 +250,11 @@ class TestMain: def test_fails_before_any_change_when_github_credentials_are_missing( self, sync, environment, monkeypatch ): - monkeypatch.setenv("GITHUB_CREDENTIALS", "") + monkeypatch.setenv("PAT_FOR_GITHUB", "") api = FakeApi([{"remote_address": "git@github.com:Org/repo.git"}]) sync["request_json"] = api - with pytest.raises(RuntimeError, match="CREDENTIALS_FOR_GITHUB"): + with pytest.raises(RuntimeError, match="PAT_FOR_GITHUB"): sync["main"]() assert all(call[0] == "GET" for call in api.calls) diff --git a/tools/publish_wiki.py b/tools/publish_wiki.py index 767370d..1d780e1 100644 --- a/tools/publish_wiki.py +++ b/tools/publish_wiki.py @@ -7,7 +7,7 @@ source; edits made in the web UI are overwritten (MIL-005). Environment: GITEA_API_URL Gitea API base, for example https://host/api/v1 SOURCE_REPOSITORY owner/repo of the repository whose wiki is written - WIKI_CREDENTIALS bare token, JSON string, or JSON with GITEA_TOKEN + WIKI_CREDENTIALS the Gitea token, as clear text WIKI_DIR directory with the pages (default: wiki) Exit codes: 0 published or nothing to do, 1 failed (message names a category). @@ -83,33 +83,15 @@ def request_json( raise WorkflowError("api", f"Gitea API is unreachable ({error}).") from None -def parse_gitea_token(raw_credentials: str | None) -> str: - """Return the token from a bare value, a JSON string or JSON with GITEA_TOKEN.""" - raw_credentials = (raw_credentials or "").strip() - if not raw_credentials: +def parse_gitea_token(raw_token: str | None) -> str: + """Return the token, or fail when the secret is missing or empty.""" + token = (raw_token or "").strip() + if not token: raise WorkflowError( "configuration", "No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.", ) - - token: Any - try: - credentials = json.loads(raw_credentials) - except json.JSONDecodeError: - token = raw_credentials - else: - if isinstance(credentials, dict): - token = credentials.get("GITEA_TOKEN") - elif isinstance(credentials, str): - token = credentials - else: - token = None - - if not isinstance(token, str) or not token.strip(): - raise WorkflowError( - "configuration", "The wiki token must contain a non-empty GITEA_TOKEN." - ) - return token.strip() + return token def describe_token(token: str) -> str: diff --git a/wiki/Capabilities.da.md b/wiki/Capabilities.da.md index f681a62..33f1b10 100644 --- a/wiki/Capabilities.da.md +++ b/wiki/Capabilities.da.md @@ -1,4 +1,4 @@ - + > Dette er en oversættelse af [`Capabilities`](Capabilities). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres. @@ -43,7 +43,7 @@ activate Workflow Workflow -> Workflow: Read and validate secrets note right TOKEN_FOR_GITEA -CREDENTIALS_FOR_GITHUB +PAT_FOR_GITHUB end note alt secret validation failed diff --git a/wiki/Capabilities.md b/wiki/Capabilities.md index 79f18c7..83af824 100644 --- a/wiki/Capabilities.md +++ b/wiki/Capabilities.md @@ -43,7 +43,7 @@ activate Workflow Workflow -> Workflow: Read and validate secrets note right TOKEN_FOR_GITEA -CREDENTIALS_FOR_GITHUB +PAT_FOR_GITHUB end note alt secret validation failed diff --git a/wiki/Capabilities.ms.md b/wiki/Capabilities.ms.md index 33d21fb..4ad1b76 100644 --- a/wiki/Capabilities.ms.md +++ b/wiki/Capabilities.ms.md @@ -1,4 +1,4 @@ - + > Ini ialah terjemahan [`Capabilities`](Capabilities). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya. @@ -43,7 +43,7 @@ activate Workflow Workflow -> Workflow: Read and validate secrets note right TOKEN_FOR_GITEA -CREDENTIALS_FOR_GITHUB +PAT_FOR_GITHUB end note alt secret validation failed diff --git a/wiki/Credentials.da.md b/wiki/Credentials.da.md index 792c3be..7a85c4e 100644 --- a/wiki/Credentials.da.md +++ b/wiki/Credentials.da.md @@ -1,4 +1,4 @@ - + > Dette er en oversættelse af [`Credentials`](Credentials). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres. @@ -10,8 +10,8 @@ Synkroniseringsworkflowet bruger to secrets. Giv hver af dem de mindste rettighe | Secret | Indhold | Bruges til | | --- | --- | --- | -| `TOKEN_FOR_GITEA` | Et almindeligt token, en JSON-streng eller JSON med `GITEA_TOKEN` | At læse repositoryet (beskrivelse, emner) og dets push-spejle | -| `CREDENTIALS_FOR_GITHUB` | JSON-objekt med et `GITHUB_PAT`, der ikke er tomt | At ændre beskrivelse og emner på GitHub-spejlet | +| `TOKEN_FOR_GITEA` | Gitea-tokenet, intet andet | At læse repositoryet (beskrivelse, emner) og dets push-spejle | +| `PAT_FOR_GITHUB` | GitHub-tokenet, intet andet | At ændre beskrivelse og emner på GitHub-spejlet | ## Mindste rettigheder @@ -33,11 +33,7 @@ Kald, der foretages: `GET /repos/{owner}/{repo}` og `GET /repos/{owner}/{repo}/p Kald, der foretages: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (beskrivelse) og `PUT /repos/{owner}/{repo}/topics`. -Format for `CREDENTIALS_FOR_GITHUB`: - -```json -{"GITHUB_PAT": ""} -``` +Format for `PAT_FOR_GITHUB`: kun token-strengen (fx `github_pat_...`) som almindelig tekst. Workflowet tjekker kun, at den ikke er tom; GitHub afviser en forkert værdi (HTTP 401). ## Hvad workflowet kontrollerer, før det ændrer noget @@ -56,7 +52,7 @@ Workflowet **Publish wiki** (kun dette repository) kopierer `wiki/` til Gitea-wi | Secret | Indhold | Bruges til | | --- | --- | --- | -| `TOKEN_FOR_GITEA_WIKI` (valgfri) | Et almindeligt token, en JSON-streng eller JSON med `GITEA_TOKEN` | At skrive wikisiderne for dette repository | +| `TOKEN_FOR_GITEA_WIKI` (valgfri) | Gitea-tokenet, intet andet | At skrive wikisiderne for dette repository | - Det token, der bruges, skal have scope `write:repository`, og dets bruger skal have skriveadgang til dette repository. Gitea har intet scope kun til wikien. - `TOKEN_FOR_GITEA` er beskrevet ovenfor med kun `read:repository`. Hvis det genbruges til wikien, skal dets scope hæves, hvilket også giver metadatasynkroniseringen skriveadgang. En separat `TOKEN_FOR_GITEA_WIKI` til en dedikeret bruger holder synkroniseringstokenet skrivebeskyttet. S05 beslutter hvilket, og S03 gemmer secreten. diff --git a/wiki/Credentials.md b/wiki/Credentials.md index 06cd826..cecdc1a 100644 --- a/wiki/Credentials.md +++ b/wiki/Credentials.md @@ -12,8 +12,8 @@ leaves. | Secret | Content | Used for | | --- | --- | --- | -| `TOKEN_FOR_GITEA` | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Reading the repository (description, topics) and its push mirrors | -| `CREDENTIALS_FOR_GITHUB` | JSON object with a non-empty `GITHUB_PAT` | Changing the description and topics of the GitHub mirror | +| `TOKEN_FOR_GITEA` | The Gitea token, nothing else | Reading the repository (description, topics) and its push mirrors | +| `PAT_FOR_GITHUB` | The GitHub token, nothing else | Changing the description and topics of the GitHub mirror | ## Minimum permissions @@ -40,11 +40,9 @@ Calls made: `GET /repos/{owner}/{repo}` and `GET /repos/{owner}/{repo}/push_mirr Calls made: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (description) and `PUT /repos/{owner}/{repo}/topics`. -Format of `CREDENTIALS_FOR_GITHUB`: - -```json -{"GITHUB_PAT": ""} -``` +Format of `PAT_FOR_GITHUB`: only the token string (for example +`github_pat_...`), as clear text. The workflow only checks that it is not empty; +GitHub rejects a wrong value (HTTP 401). ## What the workflow checks before it changes anything @@ -70,7 +68,7 @@ when that secret exists and otherwise reuses `TOKEN_FOR_GITEA`. | Secret | Content | Used for | | --- | --- | --- | -| `TOKEN_FOR_GITEA_WIKI` (optional) | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Writing the wiki pages of this repository | +| `TOKEN_FOR_GITEA_WIKI` (optional) | The Gitea token, nothing else | Writing the wiki pages of this repository | - The token that is used needs scope `write:repository`, and its user needs write access to this repository. Gitea has no wiki-only scope. diff --git a/wiki/Credentials.ms.md b/wiki/Credentials.ms.md index 94a1fab..751f7f7 100644 --- a/wiki/Credentials.ms.md +++ b/wiki/Credentials.ms.md @@ -1,4 +1,4 @@ - + > Ini ialah terjemahan [`Credentials`](Credentials). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya. @@ -10,8 +10,8 @@ Aliran kerja penyegerakan menggunakan dua rahsia (secret). Beri setiap satu keis | Secret | Kandungan | Digunakan untuk | | --- | --- | --- | -| `TOKEN_FOR_GITEA` | Token biasa, rentetan JSON, atau JSON dengan `GITEA_TOKEN` | Membaca repositori (penerangan, topik) dan push mirror-nya | -| `CREDENTIALS_FOR_GITHUB` | Objek JSON dengan `GITHUB_PAT` yang tidak kosong | Mengubah penerangan dan topik cermin GitHub | +| `TOKEN_FOR_GITEA` | Token Gitea, tiada yang lain | Membaca repositori (penerangan, topik) dan push mirror-nya | +| `PAT_FOR_GITHUB` | Token GitHub, tiada yang lain | Mengubah penerangan dan topik cermin GitHub | ## Kebenaran minimum @@ -33,11 +33,7 @@ Panggilan yang dibuat: `GET /repos/{owner}/{repo}` dan `GET /repos/{owner}/{repo Panggilan yang dibuat: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (penerangan) dan `PUT /repos/{owner}/{repo}/topics`. -Format `CREDENTIALS_FOR_GITHUB`: - -```json -{"GITHUB_PAT": ""} -``` +Format `PAT_FOR_GITHUB`: hanya rentetan token (contohnya `github_pat_...`) sebagai teks biasa. Aliran kerja hanya menyemak bahawa ia tidak kosong; GitHub menolak nilai yang salah (HTTP 401). ## Perkara yang disemak oleh aliran kerja sebelum mengubah apa-apa @@ -56,7 +52,7 @@ Aliran kerja **Publish wiki** (repositori ini sahaja) menyalin `wiki/` ke wiki G | Secret | Kandungan | Digunakan untuk | | --- | --- | --- | -| `TOKEN_FOR_GITEA_WIKI` (pilihan) | Token biasa, rentetan JSON, atau JSON dengan `GITEA_TOKEN` | Menulis halaman wiki repositori ini | +| `TOKEN_FOR_GITEA_WIKI` (pilihan) | Token Gitea, tiada yang lain | Menulis halaman wiki repositori ini | - Token yang digunakan mesti mempunyai skop `write:repository`, dan penggunanya mesti mempunyai akses tulis kepada repositori ini. Gitea tidak mempunyai skop untuk wiki sahaja. - `TOKEN_FOR_GITEA` didokumenkan di atas dengan `read:repository` sahaja. Menggunakannya semula untuk wiki bermakna meningkatkan skopnya, yang juga memberi akses tulis kepada penyegerakan metadata. `TOKEN_FOR_GITEA_WIKI` yang berasingan untuk pengguna khusus mengekalkan token penyegerakan sebagai baca sahaja. S05 memutuskan yang mana, dan S03 menyimpan secret. diff --git a/wiki/Home.da.md b/wiki/Home.da.md index fe4f7df..f660eb4 100644 --- a/wiki/Home.da.md +++ b/wiki/Home.da.md @@ -1,4 +1,4 @@ - + > Dette er en oversættelse af [`Home`](Home). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres. @@ -21,8 +21,8 @@ Det indeholder i øjeblikket Gitea-workflowet [`sync-github-metadata.yml`](https - En Gitea-instans med Actions aktiveret og en runner med labelen `ubuntu-latest` og `python3` - Et konfigureret GitHub push-spejl på Gitea-repositoryet (højst ét; repositories uden spejl springes over uden fejl) - Repository-secrets: - - `TOKEN_FOR_GITEA`: Gitea API-token (almindelig tekststreng eller JSON med `GITEA_TOKEN`) - - `CREDENTIALS_FOR_GITHUB`: JSON-objekt med `GITHUB_PAT`, et GitHub personal access token, der må redigere spejl-repositoryet + - `TOKEN_FOR_GITEA`: Gitea API-token (kun tokenet, ingen JSON) + - `PAT_FOR_GITHUB`: et GitHub personal access token, der må redigere spejl-repositoryet (kun tokenet, ingen JSON) - `TOKEN_FOR_GITEA_WIKI` (valgfri, kun i dette repository, til workflowet **Publish wiki**): Gitea-token, der kan skrive til repositoryets wiki; hvis den mangler, bruges `TOKEN_FOR_GITEA`, som så skal have skriveadgang diff --git a/wiki/Home.md b/wiki/Home.md index 7695eda..fcc1c61 100644 --- a/wiki/Home.md +++ b/wiki/Home.md @@ -21,8 +21,8 @@ It currently contains the Gitea workflow [`sync-github-metadata.yml`](https://gi - A Gitea instance with Actions enabled and a runner providing `ubuntu-latest` with `python3` - A configured GitHub push mirror on the Gitea repository (at most one; repositories without a mirror are skipped successfully) - Repository secrets: - - `TOKEN_FOR_GITEA`: Gitea API token (plain string, or JSON with `GITEA_TOKEN`) - - `CREDENTIALS_FOR_GITHUB`: JSON object containing `GITHUB_PAT`, a GitHub personal access token allowed to edit the mirror repository + - `TOKEN_FOR_GITEA`: Gitea API token (the token only, no JSON) + - `PAT_FOR_GITHUB`: a GitHub personal access token allowed to edit the mirror repository (the token only, no JSON) - `TOKEN_FOR_GITEA_WIKI` (optional, only in this repository, for the **Publish wiki** workflow): Gitea token that can write the repository wiki; when it is absent, `TOKEN_FOR_GITEA` is used and needs write access diff --git a/wiki/Home.ms.md b/wiki/Home.ms.md index d71eb77..8c7c776 100644 --- a/wiki/Home.ms.md +++ b/wiki/Home.ms.md @@ -1,4 +1,4 @@ - + > Ini ialah terjemahan [`Home`](Home). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya. @@ -21,8 +21,8 @@ Buat masa ini ia mengandungi aliran kerja Gitea [`sync-github-metadata.yml`](htt - Satu instans Gitea dengan Actions diaktifkan dan satu runner yang menyediakan `ubuntu-latest` dengan `python3` - Satu push mirror GitHub yang dikonfigurasi pada repositori Gitea (paling banyak satu; repositori tanpa cermin dilangkau dengan jayanya) - Rahsia (secret) repositori: - - `TOKEN_FOR_GITEA`: token API Gitea (rentetan biasa, atau JSON dengan `GITEA_TOKEN`) - - `CREDENTIALS_FOR_GITHUB`: objek JSON yang mengandungi `GITHUB_PAT`, iaitu personal access token GitHub yang dibenarkan mengubah suai repositori cermin + - `TOKEN_FOR_GITEA`: token API Gitea (token sahaja, tanpa JSON) + - `PAT_FOR_GITHUB`: personal access token GitHub yang dibenarkan mengubah suai repositori cermin (token sahaja, tanpa JSON) - `TOKEN_FOR_GITEA_WIKI` (pilihan, hanya dalam repositori ini, untuk aliran kerja **Publish wiki**): token Gitea yang boleh menulis ke wiki repositori; jika tiada, `TOKEN_FOR_GITEA` digunakan dan mesti mempunyai akses tulis diff --git a/wiki/Onboarding.da.md b/wiki/Onboarding.da.md index 384e1b2..b6c7396 100644 --- a/wiki/Onboarding.da.md +++ b/wiki/Onboarding.da.md @@ -1,4 +1,4 @@ - + > Dette er en oversættelse af [`Onboarding`](Onboarding). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres. @@ -24,7 +24,7 @@ Indtil leveringen er verificeret, tilsluttes et repository ved at kopiere workfl 2. **Konfigurer ét GitHub push-spejl** i repositoryets indstillinger (Settings, Repository, Mirror settings, Push mirror). Workflowet fejler, hvis der er flere GitHub-spejle. Hvis der ingen er, lykkes det uden at synkronisere noget. 3. **Tilføj de to secrets** i repositoryets (eller organisationens) indstillinger med de scopes, der står i [credentials.md](Credentials.da): - `TOKEN_FOR_GITEA` - - `CREDENTIALS_FOR_GITHUB` (JSON med `GITHUB_PAT`) + - `PAT_FOR_GITHUB` (kun GitHub-tokenet) 4. **Lever workflowet:** - *Hvis scoped workflows gælder for repositoryet:* der er intet at kopiere. - *Ellers:* kopier `.gitea/scoped_workflows/sync-github-metadata.yml` fra dette repository til `.gitea/workflows/` i mål-repositoryet. Fastlås kopien til en gennemgået version af dette repository, og kopier igen, når den ændres. diff --git a/wiki/Onboarding.md b/wiki/Onboarding.md index 6478c79..650e3d1 100644 --- a/wiki/Onboarding.md +++ b/wiki/Onboarding.md @@ -33,7 +33,7 @@ Until delivery is verified, onboard a repository by copying the workflow (below) 3. **Add the two secrets** in the repository (or organization) settings, using the scopes in [credentials.md](Credentials): - `TOKEN_FOR_GITEA` - - `CREDENTIALS_FOR_GITHUB` (JSON with `GITHUB_PAT`) + - `PAT_FOR_GITHUB` (the GitHub token only) 4. **Deliver the workflow:** - *If scoped workflows apply to the repository:* nothing to copy. - *Otherwise:* copy `.gitea/scoped_workflows/sync-github-metadata.yml` diff --git a/wiki/Onboarding.ms.md b/wiki/Onboarding.ms.md index 69fce0f..81a34fb 100644 --- a/wiki/Onboarding.ms.md +++ b/wiki/Onboarding.ms.md @@ -1,4 +1,4 @@ - + > Ini ialah terjemahan [`Onboarding`](Onboarding). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya. @@ -24,7 +24,7 @@ Selagi penghantaran belum disahkan, sertakan repositori dengan menyalin aliran k 2. **Konfigurasikan satu push mirror GitHub** dalam tetapan repositori (Settings, Repository, Mirror settings, Push mirror). Aliran kerja gagal jika terdapat beberapa cermin GitHub. Jika tiada, ia berjaya tanpa menyegerakkan apa-apa. 3. **Tambah dua rahsia (secret)** dalam tetapan repositori (atau organisasi), dengan skop yang tertera dalam [credentials.md](Credentials.ms): - `TOKEN_FOR_GITEA` - - `CREDENTIALS_FOR_GITHUB` (JSON dengan `GITHUB_PAT`) + - `PAT_FOR_GITHUB` (token GitHub sahaja) 4. **Hantar aliran kerja:** - *Jika scoped workflow terpakai pada repositori:* tiada apa yang perlu disalin. - *Jika tidak:* salin `.gitea/scoped_workflows/sync-github-metadata.yml` dari repositori ini ke `.gitea/workflows/` dalam repositori sasaran. Sematkan salinan itu pada versi repositori ini yang telah disemak, dan salin semula apabila ia berubah. diff --git a/wiki/Troubleshooting.da.md b/wiki/Troubleshooting.da.md index 1b8db94..60574da 100644 --- a/wiki/Troubleshooting.da.md +++ b/wiki/Troubleshooting.da.md @@ -1,4 +1,4 @@ - + > Dette er en oversættelse af [`Troubleshooting`](Troubleshooting). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres. @@ -26,12 +26,8 @@ Kategorien fortæller, hvor du skal kigge. En fejl uden for scriptet (jobbet sta | Meddelelse (begyndelsen) | Kategori | Årsag og løsning | | --- | --- | --- | -| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Tilføj secreten | -| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | Værdien skal være JSON, fx `{"GITHUB_PAT": "..."}` | -| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Brug et objekt, ikke en liste eller en streng | -| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Tilføj nøglen `GITHUB_PAT` med et token | +| `PAT_FOR_GITHUB is missing or empty.` | configuration | Tilføj secreten | | `TOKEN_FOR_GITEA is missing or empty.` | configuration | Tilføj secreten | -| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | JSON-formen kræver nøglen `GITEA_TOKEN` | | `Could not determine the Gitea source repository.` | configuration | Kørslen har intet repositorynavn; meld det som en defekt | | `Expected at most one GitHub push mirror ... found N` | configuration | Behold ét GitHub push-spejl | | `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Kun wiki-publicering: tilføj en af secrets (se [credentials.md](Credentials.da)) | @@ -40,7 +36,7 @@ Kategorien fortæller, hvor du skal kigge. En fejl uden for scriptet (jobbet sta | `The wiki source directory ... has no Markdown pages` | configuration | Kun wiki-publicering: `wiki/` er tom eller mangler; intet blev ændret | | `Could not determine the GitHub owner and repository ...` | configuration | Spejlets adresse skal se ud som `https://github.com//.git` | | `Gitea API request failed with HTTP 401` | credentials | Opret et nyt Gitea-token, og opdatér `TOKEN_FOR_GITEA` | -| `GitHub API request failed with HTTP 401` | credentials | Opret et nyt GitHub-token, og opdatér `CREDENTIALS_FOR_GITHUB` | +| `GitHub API request failed with HTTP 401` | credentials | Opret et nyt GitHub-token, og opdatér `PAT_FOR_GITHUB`; værdien skal kun være tokenet (intet navn, ingen anførselstegn eller JSON) | | `... HTTP 403 ...` (Gitea) | permissions | Tokenet skal have `read:repository`, og dets bruger skal være administrator af repositoryet | | `... HTTP 403 ...` (GitHub) | permissions | Tokenet skal have Administration read and write på spejl-repositoryet | | `The GitHub token cannot administer ` | permissions | Som ovenfor; tokenet kan læse repositoryet, men ikke redigere det | diff --git a/wiki/Troubleshooting.md b/wiki/Troubleshooting.md index 5abd420..ffe9ffa 100644 --- a/wiki/Troubleshooting.md +++ b/wiki/Troubleshooting.md @@ -28,12 +28,8 @@ never starts, or stops before the step) is a **runner** problem. | Message (start) | Category | Cause and fix | | --- | --- | --- | -| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Add the secret | -| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | The value must be JSON such as `{"GITHUB_PAT": "..."}` | -| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Use an object, not a list or string | -| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Add the `GITHUB_PAT` key with a token | +| `PAT_FOR_GITHUB is missing or empty.` | configuration | Add the secret | | `TOKEN_FOR_GITEA is missing or empty.` | configuration | Add the secret | -| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | The JSON form needs a `GITEA_TOKEN` key | | `Could not determine the Gitea source repository.` | configuration | The run has no repository name; report as a defect | | `Expected at most one GitHub push mirror ... found N` | configuration | Keep one GitHub push mirror | | `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Wiki publishing only: add one of the secrets (see [credentials.md](Credentials)) | @@ -42,7 +38,7 @@ never starts, or stops before the step) is a **runner** problem. | `The wiki source directory ... has no Markdown pages` | configuration | Wiki publishing only: `wiki/` is empty or missing; nothing was changed | | `Could not determine the GitHub owner and repository ...` | configuration | The mirror address must look like `https://github.com//.git` | | `Gitea API request failed with HTTP 401` | credentials | Create a new Gitea token and update `TOKEN_FOR_GITEA` | -| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `CREDENTIALS_FOR_GITHUB` | +| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `PAT_FOR_GITHUB`; the value must be the token only (no name, quotes or JSON) | | `... HTTP 403 ...` (Gitea) | permissions | Token needs `read:repository`, and its user needs administrator access to the repository | | `... HTTP 403 ...` (GitHub) | permissions | Token needs Administration read and write on the mirror repository | | `The GitHub token cannot administer ` | permissions | Same as above; the token can read the repository but not edit it | diff --git a/wiki/Troubleshooting.ms.md b/wiki/Troubleshooting.ms.md index 5bd6116..229f880 100644 --- a/wiki/Troubleshooting.ms.md +++ b/wiki/Troubleshooting.ms.md @@ -1,4 +1,4 @@ - + > Ini ialah terjemahan [`Troubleshooting`](Troubleshooting). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya. @@ -26,12 +26,8 @@ Kategori menunjukkan di mana perlu dilihat. Kegagalan di luar skrip (kerja tidak | Mesej (permulaan) | Kategori | Punca dan pembetulan | | --- | --- | --- | -| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Tambah secret | -| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | Nilai mesti JSON seperti `{"GITHUB_PAT": "..."}` | -| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Gunakan objek, bukan senarai atau rentetan | -| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Tambah kunci `GITHUB_PAT` dengan token | +| `PAT_FOR_GITHUB is missing or empty.` | configuration | Tambah secret | | `TOKEN_FOR_GITEA is missing or empty.` | configuration | Tambah secret | -| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | Bentuk JSON memerlukan kunci `GITEA_TOKEN` | | `Could not determine the Gitea source repository.` | configuration | Larian tiada nama repositori; laporkan sebagai kecacatan | | `Expected at most one GitHub push mirror ... found N` | configuration | Kekalkan satu push mirror GitHub | | `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Penerbitan wiki sahaja: tambah salah satu secret (lihat [credentials.md](Credentials.ms)) | @@ -40,7 +36,7 @@ Kategori menunjukkan di mana perlu dilihat. Kegagalan di luar skrip (kerja tidak | `The wiki source directory ... has no Markdown pages` | configuration | Penerbitan wiki sahaja: `wiki/` kosong atau tiada; tiada apa-apa diubah | | `Could not determine the GitHub owner and repository ...` | configuration | Alamat cermin mesti kelihatan seperti `https://github.com//.git` | | `Gitea API request failed with HTTP 401` | credentials | Cipta token Gitea baharu dan kemas kini `TOKEN_FOR_GITEA` | -| `GitHub API request failed with HTTP 401` | credentials | Cipta token GitHub baharu dan kemas kini `CREDENTIALS_FOR_GITHUB` | +| `GitHub API request failed with HTTP 401` | credentials | Cipta token GitHub baharu dan kemas kini `PAT_FOR_GITHUB`; nilai mesti token sahaja (tiada nama, tanda petikan atau JSON) | | `... HTTP 403 ...` (Gitea) | permissions | Token memerlukan `read:repository`, dan penggunanya mesti pentadbir repositori | | `... HTTP 403 ...` (GitHub) | permissions | Token memerlukan Administration read and write pada repositori cermin | | `The GitHub token cannot administer ` | permissions | Sama seperti di atas; token boleh membaca repositori tetapi tidak boleh mengeditnya |