TirSystem/github-action
0
1
Fork 0
Code Issues 5 Pull Requests 1 Actions Packages Projects Releases 3 Wiki Activity

Use bare tokens: PAT_FOR_GITHUB replaces CREDENTIALS_FOR_GITHUB #51

Merged
Tirsvad merged 4 commits from pat-for-github into main 2026-10-10 04:44:41 +02:00
Conversation 0 Commits 4 Files Changed 27
+148 -211
27 changed files with 148 additions and 211 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/scoped_workflows/sync-github-metadata.yml
+11 -50
View File
@@ -18,7 +18,7 @@ jobs:
GITEA_API_URL: ${{ gitea.api_url }}
GITEA_CREDENTIALS: ${{ secrets.TOKEN_FOR_GITEA }}
SOURCE_REPOSITORY: ${{ gitea.repository }}
GITHUB_CREDENTIALS: ${{ secrets.CREDENTIALS_FOR_GITHUB }}
PAT_FOR_GITHUB: ${{ secrets.PAT_FOR_GITHUB }}
run: |
python3 - <<'PY'
import json
@@ -87,61 +87,22 @@ jobs:
) from None
def parse_github_token(raw_credentials):
raw_credentials = (raw_credentials or "").strip()
if not raw_credentials:
def parse_github_token(raw_token):
token = (raw_token or "").strip()
if not token:
raise WorkflowError(
"configuration", "CREDENTIALS_FOR_GITHUB is missing or empty."
"configuration", "PAT_FOR_GITHUB is missing or empty."
)
try:
credentials = json.loads(raw_credentials)
except json.JSONDecodeError:
raise WorkflowError(
"configuration",
"CREDENTIALS_FOR_GITHUB must contain valid JSON.",
) from None
if not isinstance(credentials, dict):
raise WorkflowError(
"configuration",
"CREDENTIALS_FOR_GITHUB must be a JSON object.",
)
token = credentials.get("GITHUB_PAT")
if not isinstance(token, str) or not token.strip():
raise WorkflowError(
"configuration",
"CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.",
)
return token.strip()
return token
def parse_gitea_token(raw_credentials):
raw_credentials = (raw_credentials or "").strip()
if not raw_credentials:
def parse_gitea_token(raw_token):
token = (raw_token or "").strip()
if not token:
raise WorkflowError(
"configuration", "TOKEN_FOR_GITEA is missing or empty."
)
try:
credentials = json.loads(raw_credentials)
except json.JSONDecodeError:
token = raw_credentials
else:
if isinstance(credentials, dict):
token = credentials.get("GITEA_TOKEN")
elif isinstance(credentials, str):
token = credentials
else:
token = None
if not isinstance(token, str) or not token.strip():
raise WorkflowError(
"configuration",
"TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.",
)
return token.strip()
return token
def split_repository(full_name):
@@ -219,7 +180,7 @@ jobs:
)
return 0
github_token = parse_github_token(os.environ.get("GITHUB_CREDENTIALS"))
github_token = parse_github_token(os.environ.get("PAT_FOR_GITHUB"))
github_owner, github_repo = target
github_api_url = (
"https://api.github.com/repos/"
README.md
+3 -3
View File
@@ -23,8 +23,8 @@ It currently contains the Gitea workflow [`sync-github-metadata.yml`](.gitea/sco
- A Gitea instance with Actions enabled and a runner providing `ubuntu-latest` with `python3`
- A configured GitHub push mirror on the Gitea repository (at most one; repositories without a mirror are skipped successfully)
- Repository secrets:
- `TOKEN_FOR_GITEA`: Gitea API token (plain string, or JSON with `GITEA_TOKEN`)
- `CREDENTIALS_FOR_GITHUB`: JSON object containing `GITHUB_PAT`, a GitHub personal access token allowed to edit the mirror repository
- `TOKEN_FOR_GITEA`: Gitea API token (the token only, no JSON)
- `PAT_FOR_GITHUB`: a GitHub personal access token allowed to edit the mirror repository (the token only, no JSON)
- `TOKEN_FOR_GITEA_WIKI` (optional, only in this repository, for the **Publish wiki** workflow): Gitea token that can write the repository wiki; when it is absent, `TOKEN_FOR_GITEA` is used and needs write access
## 🛠️ Setup
@@ -96,7 +96,7 @@ activate Workflow
Workflow -> Workflow: Read and validate secrets
note right
TOKEN_FOR_GITEA
CREDENTIALS_FOR_GITHUB
PAT_FOR_GITHUB
end note
alt secret validation failed
docs/artifact-registry.md
+1 -1
View File
@@ -11,7 +11,7 @@ each document lives in *this* project and the next version to use.
| SA | Stakeholder Analysis | docs/stakeholder-analysis.md | 002 |
| PP | Project Plan | docs/project-plan.md | 002 |
| MIL | Milestone / Gateway | docs/milestones/*.md | 006 |
| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 015 |
| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 016 |
| TM | Traceability Matrix | docs/sqa/traceability-matrix.md | 002 |
| ADR | Architecture Decision Record | docs/adr/adr-NNNN-*.md | 0004 |
docs/project-plan.md
+6 -8
View File
@@ -9,8 +9,8 @@
## Version History
| Date | Status | Author | Reviewer | Change | Commit |
| --- | --- | --- | --- | --- | --- |
| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Added gateway MIL-005 (wiki and translations) | [08ef26a] |
| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Last decision date is 2026-12-12 after adding MIL-005 | [ae4e257] |
| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | UC candidate 2 names the secret PAT_FOR_GITHUB | [a26a491] |
| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Reviewed (RC-015): JSON removed from the credential failures, answered MIL-001 decisions removed from Open Issues | [b282e10] |
---
@@ -81,8 +81,6 @@ A No-Go moves every later window by the rework time of the failed milestone.
## Open Issues
- Confirm the proposed dates and the start week (S01 and S05).
- Decide the behavior for an invalid push mirror response (MIL-001 task 1).
- Decide the canonical location of the workflow source (MIL-001 task 3).
- No QC checklist exists for the Project Plan.
- Formal use cases need a use case diagram and user stories first; neither exists yet.
@@ -134,8 +132,8 @@ no tests, no release process.
- **Trigger:** onboarding a repository or rotating a token.
- **Preconditions:** access to Gitea and GitHub settings.
- **Success:** a workflow run passes credential checks with the documented minimum permissions.
- **Main flow:** create the tokens, store `TOKEN_FOR_GITEA` and `CREDENTIALS_FOR_GITHUB`, run the workflow, read the validation result.
- **Alternatives and failures:** malformed JSON, empty value, expired token, missing permission: the check names the category without printing the secret.
- **Main flow:** create the tokens, store `TOKEN_FOR_GITEA` and `PAT_FOR_GITHUB`, run the workflow, read the validation result.
- **Alternatives and failures:** empty value, wrong or expired token (rejected with HTTP 401), missing permission: the check names the category without printing the secret.
- **Dependencies:** use case 1.
### UC candidate 3: Onboard a repository to standard workflows (P1)
@@ -252,5 +250,5 @@ no tests, no release process.
[Milestone MIL-003]: https://git.tirsystem.com/TirSystem/github-action/milestone/20
[Milestone MIL-004]: https://git.tirsystem.com/TirSystem/github-action/milestone/21
[Milestone MIL-005]: https://git.tirsystem.com/TirSystem/github-action/milestone/93
[08ef26a]: https://git.tirsystem.com/TirSystem/github-action/commit/08ef26a6d3eb98c066b45634c2271e578e6c0a0b
[ae4e257]: https://git.tirsystem.com/TirSystem/github-action/commit/ae4e257236095e76132980fad1e9a661b1d082c7
[a26a491]: https://git.tirsystem.com/TirSystem/github-action/commit/a26a49173718b89785ea4a6e4c8bdbfb9aca975d
[b282e10]: https://git.tirsystem.com/TirSystem/github-action/commit/b282e107416a890d6df27e6bdf23ab8a65e17123
docs/sqa/reviews/rc-015-project-plan-pat.md
+47
View File
@@ -0,0 +1,47 @@
# Review Record: PP-001 Project Plan (PAT_FOR_GITHUB, open issues)
## Metadata
| Key | Value |
| --- | --- |
| ID | RC-015 |
| CrossReference | [PP-001], [BC-001] |
## Version History
| Date | Status | Author | Reviewer | Change | Commit |
| --- | --- | --- | --- | --- | --- |
| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version | [b282e10] |
---
## Artifact Under Review
- Instance reviewed: [PP-001]
- Checklist used: none: the Project Plan has no QC checklist. Validated against the Business Case [BC-001] and the Go / No-Go criteria of each listed milestone, as `PP.md` prescribes.
## Checklist Results
| # | Criterion | Status | Evidence/Notes |
| --- | --- | --- | --- |
| 1 | Every milestone in the plan has a `MIL-*` document and the plan's dates equal that document's target date | Pass | MIL-001 to MIL-005 exist; decision dates equal each Target Date. |
| 2 | Every Business Case scope item is covered by a gateway | Pass | Unchanged; Scope Coverage maps all items. |
| 3 | The schedule respects the Business Case constraints | Pass | The Business Case sets no deadline; dates are marked as proposals. |
| 4 | Dependencies between milestones are stated | Pass | Unchanged. |
| 5 | Every gateway has an owner who is a stakeholder ID | Pass | All five gateways are owned by S05. |
| 6 | Plan content is internally consistent | Pass | Finding fixed during this review: UC candidate 2 still listed "malformed JSON" as a credential failure although no secret is JSON any more. It now lists the empty value, a wrong or expired token (HTTP 401) and a missing permission. The secret names match the code and the guides. |
| 7 | Open Issues are current | Pass | Finding fixed during this review: the MIL-001 task 1 and task 3 decisions were made and are recorded in MIL-001, so they are removed. The remaining items are still open: confirm dates, no QC checklist for the Project Plan, formal use cases wait for a diagram and user stories. This closes the RC-009 action item. |
## Overall Verdict
Go - all seven criteria pass; the two findings were fixed during the review. S01 gave the Go in chat on 2026-10-10, standing in for the other reviewers as ADR-0002 records; there is no independent reader.
## Action Items
| Action | Owner | Due |
| --- | --- | --- |
| Confirm the proposed dates and the start week (already in Open Issues) | S01 | 2026-10-17 |
---
[PP-001]: ../../project-plan.md
[BC-001]: ../../business-case.md
[b282e10]: https://git.tirsystem.com/TirSystem/github-action/commit/b282e107416a890d6df27e6bdf23ab8a65e17123
docs/sqa/traceability-matrix.md
+7 -5
View File
@@ -4,13 +4,13 @@
| Key | Value |
| --- | --- |
| ID | TM-001 |
| CrossReference | [BC-001], [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005], [RC-001], [RC-002], [RC-003], [RC-004], [RC-005], [RC-006], [RC-007], [RC-008], [RC-009], [RC-010], [RC-011], [RC-012], [RC-013], [RC-014], [ADR-0001], [ADR-0002], [ADR-0003] |
| CrossReference | [BC-001], [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005], [RC-001], [RC-002], [RC-003], [RC-004], [RC-005], [RC-006], [RC-007], [RC-008], [RC-009], [RC-010], [RC-011], [RC-012], [RC-013], [RC-014], [RC-015], [ADR-0001], [ADR-0002], [ADR-0003] |
## Version History
| Date | Status | Author | Reviewer | Change | Commit |
| --- | --- | --- | --- | --- | --- |
| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Added ADR-0001 and RC-012 | [d0618d9] |
| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Added ADR-0002, ADR-0003 and RC-013, RC-014 | [bc3bd07] |
| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Added ADR-0002, ADR-0003 and RC-013, RC-014 | [bc3bd07] |
| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Added RC-015 for PP-001 | [b282e10] |
---
@@ -26,7 +26,7 @@ updated whenever an artifact instance is created or reviewed.
| --- | --- | --- | --- | --- |
| [SA-001] | SA | - | [BC-001] | [RC-004] |
| [BC-001] | BC | [SA-001] | [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005] | [RC-001], [RC-008] |
| [PP-001] | PP | [BC-001], [SA-001] | [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005] | [RC-002], [RC-009] |
| [PP-001] | PP | [BC-001], [SA-001] | [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005] | [RC-002], [RC-009], [RC-015] |
| [MIL-001] | MIL | [BC-001], [PP-001] | [MIL-002] | [RC-003] |
| [MIL-002] | MIL | [BC-001], [PP-001], [MIL-001] | [MIL-003], [MIL-005] | [RC-005] |
| [MIL-003] | MIL | [BC-001], [PP-001], [MIL-002] | [MIL-004] | [RC-006] |
@@ -49,6 +49,7 @@ updated whenever an artifact instance is created or reviewed.
| [RC-012] | RC | [ADR-0001] | - | - |
| [RC-013] | RC | [ADR-0002] | - | - |
| [RC-014] | RC | [ADR-0003] | - | - |
| [RC-015] | RC | [PP-001] | - | - |
## Coverage Notes
@@ -84,5 +85,6 @@ updated whenever an artifact instance is created or reviewed.
[ADR-0003]: ../adr/adr-0003-wiki-publish-token.md
[RC-013]: ./reviews/rc-013-adr-0002.md
[RC-014]: ./reviews/rc-014-adr-0003.md
[d0618d9]: https://git.tirsystem.com/TirSystem/github-action/commit/d0618d929f2ec274d30b10bb1be306e1f04c31ee
[RC-015]: ./reviews/rc-015-project-plan-pat.md
[bc3bd07]: https://git.tirsystem.com/TirSystem/github-action/commit/bc3bd07b29a0a3dcf45045b9baac64c36144c6d1
[b282e10]: https://git.tirsystem.com/TirSystem/github-action/commit/b282e107416a890d6df27e6bdf23ab8a65e17123
guides/credentials.md
+6 -8
View File
@@ -6,8 +6,8 @@ leaves.
| Secret | Content | Used for |
| --- | --- | --- |
| `TOKEN_FOR_GITEA` | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Reading the repository (description, topics) and its push mirrors |
| `CREDENTIALS_FOR_GITHUB` | JSON object with a non-empty `GITHUB_PAT` | Changing the description and topics of the GitHub mirror |
| `TOKEN_FOR_GITEA` | The Gitea token, nothing else | Reading the repository (description, topics) and its push mirrors |
| `PAT_FOR_GITHUB` | The GitHub token, nothing else | Changing the description and topics of the GitHub mirror |
## Minimum permissions
@@ -34,11 +34,9 @@ Calls made: `GET /repos/{owner}/{repo}` and `GET /repos/{owner}/{repo}/push_mirr
Calls made: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (description)
and `PUT /repos/{owner}/{repo}/topics`.
Format of `CREDENTIALS_FOR_GITHUB`:
```json
{"GITHUB_PAT": "<token>"}
```
Format of `PAT_FOR_GITHUB`: only the token string (for example
`github_pat_...`), as clear text. The workflow only checks that it is not empty;
GitHub rejects a wrong value (HTTP 401).
## What the workflow checks before it changes anything
@@ -64,7 +62,7 @@ when that secret exists and otherwise reuses `TOKEN_FOR_GITEA`.
| Secret | Content | Used for |
| --- | --- | --- |
| `TOKEN_FOR_GITEA_WIKI` (optional) | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Writing the wiki pages of this repository |
| `TOKEN_FOR_GITEA_WIKI` (optional) | The Gitea token, nothing else | Writing the wiki pages of this repository |
- The token that is used needs scope `write:repository`, and its user needs
write access to this repository. Gitea has no wiki-only scope.
guides/onboarding.md
+1 -1
View File
@@ -27,7 +27,7 @@ Until delivery is verified, onboard a repository by copying the workflow (below)
3. **Add the two secrets** in the repository (or organization) settings,
using the scopes in [credentials.md](credentials.md):
- `TOKEN_FOR_GITEA`
- `CREDENTIALS_FOR_GITHUB` (JSON with `GITHUB_PAT`)
- `PAT_FOR_GITHUB` (the GitHub token only)
4. **Deliver the workflow:**
- *If scoped workflows apply to the repository:* nothing to copy.
- *Otherwise:* copy `.gitea/scoped_workflows/sync-github-metadata.yml`
guides/troubleshooting.md
+2 -6
View File
@@ -22,12 +22,8 @@ never starts, or stops before the step) is a **runner** problem.
| Message (start) | Category | Cause and fix |
| --- | --- | --- |
| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | The value must be JSON such as `{"GITHUB_PAT": "..."}` |
| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Use an object, not a list or string |
| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Add the `GITHUB_PAT` key with a token |
| `PAT_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
| `TOKEN_FOR_GITEA is missing or empty.` | configuration | Add the secret |
| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | The JSON form needs a `GITEA_TOKEN` key |
| `Could not determine the Gitea source repository.` | configuration | The run has no repository name; report as a defect |
| `Expected at most one GitHub push mirror ... found N` | configuration | Keep one GitHub push mirror |
| `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Wiki publishing only: add one of the secrets (see [credentials.md](credentials.md)) |
@@ -36,7 +32,7 @@ never starts, or stops before the step) is a **runner** problem.
| `The wiki source directory ... has no Markdown pages` | configuration | Wiki publishing only: `wiki/` is empty or missing; nothing was changed |
| `Could not determine the GitHub owner and repository ...` | configuration | The mirror address must look like `https://github.com/<owner>/<repo>.git` |
| `Gitea API request failed with HTTP 401` | credentials | Create a new Gitea token and update `TOKEN_FOR_GITEA` |
| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `CREDENTIALS_FOR_GITHUB` |
| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `PAT_FOR_GITHUB`; the value must be the token only (no name, quotes or JSON) |
| `... HTTP 403 ...` (Gitea) | permissions | Token needs `read:repository`, and its user needs administrator access to the repository |
| `... HTTP 403 ...` (GitHub) | permissions | Token needs Administration read and write on the mirror repository |
| `The GitHub token cannot administer <repo>` | permissions | Same as above; the token can read the repository but not edit it |
tests/test_publish_wiki.py
+4 -8
View File
@@ -29,19 +29,15 @@ def b64(text: str) -> str:
class TestParseGiteaToken:
def test_accepts_bare_token(self):
assert publish_wiki.parse_gitea_token(" abc ") == "abc"
def test_returns_the_stripped_token(self):
assert publish_wiki.parse_gitea_token(" abc \n") == "abc"
def test_accepts_json_object_and_string(self):
assert publish_wiki.parse_gitea_token('{"GITEA_TOKEN": "abc"}') == "abc"
assert publish_wiki.parse_gitea_token('"abc"') == "abc"
@pytest.mark.parametrize("raw", [None, "", " ", "{}", '{"GITEA_TOKEN": ""}', "[1]"])
@pytest.mark.parametrize("raw", [None, "", " "])
def test_rejects_missing_or_empty_token(self, raw):
with pytest.raises(publish_wiki.WorkflowError) as caught:
publish_wiki.parse_gitea_token(raw)
assert caught.value.category == "configuration"
assert "TOKEN_FOR_GITEA" in str(caught.value) or "wiki token" in str(caught.value)
assert "No token for the wiki" in str(caught.value)
class TestReadPages:
tests/test_sync_github_metadata.py
+12 -33
View File
@@ -15,49 +15,28 @@ def sync():
class TestGithubToken:
def test_returns_stripped_token_from_json_object(self, sync):
raw = json.dumps({"GITHUB_PAT": " ghp_abc "})
assert sync["parse_github_token"](raw) == "ghp_abc"
def test_returns_the_stripped_token(self, sync):
assert sync["parse_github_token"](" ghp_abc\n") == "ghp_abc"
def test_accepts_a_fine_grained_token(self, sync):
token = "github_pat_11ABCDEFG0abcdefghijkl_mnopqrstuvwxyz0123456789"
assert sync["parse_github_token"](token) == token
@pytest.mark.parametrize("raw", [None, "", " "])
def test_rejects_missing_or_empty_value(self, sync, raw):
with pytest.raises(RuntimeError, match="missing or empty"):
sync["parse_github_token"](raw)
def test_rejects_invalid_json(self, sync):
with pytest.raises(RuntimeError, match="valid JSON"):
sync["parse_github_token"]("ghp_plain_token")
def test_rejects_json_that_is_not_an_object(self, sync):
with pytest.raises(RuntimeError, match="JSON object"):
sync["parse_github_token"]('["x"]')
@pytest.mark.parametrize("value", [{}, {"GITHUB_PAT": ""}, {"GITHUB_PAT": 5}])
def test_rejects_missing_or_invalid_pat(self, sync, value):
with pytest.raises(RuntimeError, match="GITHUB_PAT"):
sync["parse_github_token"](json.dumps(value))
class TestGiteaToken:
def test_accepts_bare_token(self, sync):
assert sync["parse_gitea_token"]("abc123") == "abc123"
def test_accepts_json_object(self, sync):
assert sync["parse_gitea_token"]('{"GITEA_TOKEN": " t "}') == "t"
def test_accepts_json_string(self, sync):
assert sync["parse_gitea_token"]('"quoted"') == "quoted"
def test_returns_the_stripped_token(self, sync):
assert sync["parse_gitea_token"](" abc123\n") == "abc123"
@pytest.mark.parametrize("raw", [None, "", " "])
def test_rejects_missing_or_empty_value(self, sync, raw):
with pytest.raises(RuntimeError, match="missing or empty"):
sync["parse_gitea_token"](raw)
@pytest.mark.parametrize("raw", ["{}", '{"GITEA_TOKEN": ""}', "12", "[]"])
def test_rejects_value_without_token(self, sync, raw):
with pytest.raises(RuntimeError, match="GITEA_TOKEN"):
sync["parse_gitea_token"](raw)
class TestSplitRepository:
def test_splits_owner_and_repo(self, sync):
@@ -199,7 +178,7 @@ def environment(monkeypatch):
monkeypatch.setenv("GITEA_API_URL", "https://git.example.test/api/v1/")
monkeypatch.setenv("GITEA_CREDENTIALS", "gitea-token")
monkeypatch.setenv("SOURCE_REPOSITORY", "TirSystem/repo")
monkeypatch.setenv("GITHUB_CREDENTIALS", json.dumps({"GITHUB_PAT": "gh-token"}))
monkeypatch.setenv("PAT_FOR_GITHUB", "gh-token")
class TestMain:
@@ -258,7 +237,7 @@ class TestMain:
def test_succeeds_without_changes_when_no_github_mirror_exists(
self, sync, environment, monkeypatch, capsys, mirrors
):
monkeypatch.setenv("GITHUB_CREDENTIALS", "")
monkeypatch.setenv("PAT_FOR_GITHUB", "")
api = FakeApi(mirrors)
sync["request_json"] = api
@@ -271,11 +250,11 @@ class TestMain:
def test_fails_before_any_change_when_github_credentials_are_missing(
self, sync, environment, monkeypatch
):
monkeypatch.setenv("GITHUB_CREDENTIALS", "")
monkeypatch.setenv("PAT_FOR_GITHUB", "")
api = FakeApi([{"remote_address": "git@github.com:Org/repo.git"}])
sync["request_json"] = api
with pytest.raises(RuntimeError, match="CREDENTIALS_FOR_GITHUB"):
with pytest.raises(RuntimeError, match="PAT_FOR_GITHUB"):
sync["main"]()
assert all(call[0] == "GET" for call in api.calls)
tools/publish_wiki.py
+6 -24
View File
@@ -7,7 +7,7 @@ source; edits made in the web UI are overwritten (MIL-005).
Environment:
GITEA_API_URL Gitea API base, for example https://host/api/v1
SOURCE_REPOSITORY owner/repo of the repository whose wiki is written
WIKI_CREDENTIALS bare token, JSON string, or JSON with GITEA_TOKEN
WIKI_CREDENTIALS the Gitea token, as clear text
WIKI_DIR directory with the pages (default: wiki)
Exit codes: 0 published or nothing to do, 1 failed (message names a category).
@@ -83,33 +83,15 @@ def request_json(
raise WorkflowError("api", f"Gitea API is unreachable ({error}).") from None
def parse_gitea_token(raw_credentials: str | None) -> str:
"""Return the token from a bare value, a JSON string or JSON with GITEA_TOKEN."""
raw_credentials = (raw_credentials or "").strip()
if not raw_credentials:
def parse_gitea_token(raw_token: str | None) -> str:
"""Return the token, or fail when the secret is missing or empty."""
token = (raw_token or "").strip()
if not token:
raise WorkflowError(
"configuration",
"No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.",
)
token: Any
try:
credentials = json.loads(raw_credentials)
except json.JSONDecodeError:
token = raw_credentials
else:
if isinstance(credentials, dict):
token = credentials.get("GITEA_TOKEN")
elif isinstance(credentials, str):
token = credentials
else:
token = None
if not isinstance(token, str) or not token.strip():
raise WorkflowError(
"configuration", "The wiki token must contain a non-empty GITEA_TOKEN."
)
return token.strip()
return token
def describe_token(token: str) -> str:
wiki/Capabilities.da.md
+2 -2
View File
@@ -1,4 +1,4 @@
<!-- translation of Capabilities.md, source sha256 468c912e521b -->
<!-- translation of Capabilities.md, source sha256 5856fdc70a30 -->
> Dette er en oversættelse af [`Capabilities`](Capabilities). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
@@ -43,7 +43,7 @@ activate Workflow
Workflow -> Workflow: Read and validate secrets
note right
TOKEN_FOR_GITEA
CREDENTIALS_FOR_GITHUB
PAT_FOR_GITHUB
end note
alt secret validation failed
wiki/Capabilities.md
+1 -1
View File
@@ -43,7 +43,7 @@ activate Workflow
Workflow -> Workflow: Read and validate secrets
note right
TOKEN_FOR_GITEA
CREDENTIALS_FOR_GITHUB
PAT_FOR_GITHUB
end note
alt secret validation failed
wiki/Capabilities.ms.md
+2 -2
View File
@@ -1,4 +1,4 @@
<!-- translation of Capabilities.md, source sha256 468c912e521b -->
<!-- translation of Capabilities.md, source sha256 5856fdc70a30 -->
> Ini ialah terjemahan [`Capabilities`](Capabilities). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
@@ -43,7 +43,7 @@ activate Workflow
Workflow -> Workflow: Read and validate secrets
note right
TOKEN_FOR_GITEA
CREDENTIALS_FOR_GITHUB
PAT_FOR_GITHUB
end note
alt secret validation failed
wiki/Credentials.da.md
+5 -9
View File
@@ -1,4 +1,4 @@
<!-- translation of Credentials.md, source sha256 57f66acfdc0a -->
<!-- translation of Credentials.md, source sha256 b810a21a07d5 -->
> Dette er en oversættelse af [`Credentials`](Credentials). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
@@ -10,8 +10,8 @@ Synkroniseringsworkflowet bruger to secrets. Giv hver af dem de mindste rettighe
| Secret | Indhold | Bruges til |
| --- | --- | --- |
| `TOKEN_FOR_GITEA` | Et almindeligt token, en JSON-streng eller JSON med `GITEA_TOKEN` | At læse repositoryet (beskrivelse, emner) og dets push-spejle |
| `CREDENTIALS_FOR_GITHUB` | JSON-objekt med et `GITHUB_PAT`, der ikke er tomt | At ændre beskrivelse og emner på GitHub-spejlet |
| `TOKEN_FOR_GITEA` | Gitea-tokenet, intet andet | At læse repositoryet (beskrivelse, emner) og dets push-spejle |
| `PAT_FOR_GITHUB` | GitHub-tokenet, intet andet | At ændre beskrivelse og emner på GitHub-spejlet |
## Mindste rettigheder
@@ -33,11 +33,7 @@ Kald, der foretages: `GET /repos/{owner}/{repo}` og `GET /repos/{owner}/{repo}/p
Kald, der foretages: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (beskrivelse) og `PUT /repos/{owner}/{repo}/topics`.
Format for `CREDENTIALS_FOR_GITHUB`:
```json
{"GITHUB_PAT": "<token>"}
```
Format for `PAT_FOR_GITHUB`: kun token-strengen (fx `github_pat_...`) som almindelig tekst. Workflowet tjekker kun, at den ikke er tom; GitHub afviser en forkert værdi (HTTP 401).
## Hvad workflowet kontrollerer, før det ændrer noget
@@ -56,7 +52,7 @@ Workflowet **Publish wiki** (kun dette repository) kopierer `wiki/` til Gitea-wi
| Secret | Indhold | Bruges til |
| --- | --- | --- |
| `TOKEN_FOR_GITEA_WIKI` (valgfri) | Et almindeligt token, en JSON-streng eller JSON med `GITEA_TOKEN` | At skrive wikisiderne for dette repository |
| `TOKEN_FOR_GITEA_WIKI` (valgfri) | Gitea-tokenet, intet andet | At skrive wikisiderne for dette repository |
- Det token, der bruges, skal have scope `write:repository`, og dets bruger skal have skriveadgang til dette repository. Gitea har intet scope kun til wikien.
- `TOKEN_FOR_GITEA` er beskrevet ovenfor med kun `read:repository`. Hvis det genbruges til wikien, skal dets scope hæves, hvilket også giver metadatasynkroniseringen skriveadgang. En separat `TOKEN_FOR_GITEA_WIKI` til en dedikeret bruger holder synkroniseringstokenet skrivebeskyttet. S05 beslutter hvilket, og S03 gemmer secreten.
wiki/Credentials.md
+6 -8
View File
@@ -12,8 +12,8 @@ leaves.
| Secret | Content | Used for |
| --- | --- | --- |
| `TOKEN_FOR_GITEA` | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Reading the repository (description, topics) and its push mirrors |
| `CREDENTIALS_FOR_GITHUB` | JSON object with a non-empty `GITHUB_PAT` | Changing the description and topics of the GitHub mirror |
| `TOKEN_FOR_GITEA` | The Gitea token, nothing else | Reading the repository (description, topics) and its push mirrors |
| `PAT_FOR_GITHUB` | The GitHub token, nothing else | Changing the description and topics of the GitHub mirror |
## Minimum permissions
@@ -40,11 +40,9 @@ Calls made: `GET /repos/{owner}/{repo}` and `GET /repos/{owner}/{repo}/push_mirr
Calls made: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (description)
and `PUT /repos/{owner}/{repo}/topics`.
Format of `CREDENTIALS_FOR_GITHUB`:
```json
{"GITHUB_PAT": "<token>"}
```
Format of `PAT_FOR_GITHUB`: only the token string (for example
`github_pat_...`), as clear text. The workflow only checks that it is not empty;
GitHub rejects a wrong value (HTTP 401).
## What the workflow checks before it changes anything
@@ -70,7 +68,7 @@ when that secret exists and otherwise reuses `TOKEN_FOR_GITEA`.
| Secret | Content | Used for |
| --- | --- | --- |
| `TOKEN_FOR_GITEA_WIKI` (optional) | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Writing the wiki pages of this repository |
| `TOKEN_FOR_GITEA_WIKI` (optional) | The Gitea token, nothing else | Writing the wiki pages of this repository |
- The token that is used needs scope `write:repository`, and its user needs
write access to this repository. Gitea has no wiki-only scope.
wiki/Credentials.ms.md
+5 -9
View File
@@ -1,4 +1,4 @@
<!-- translation of Credentials.md, source sha256 57f66acfdc0a -->
<!-- translation of Credentials.md, source sha256 b810a21a07d5 -->
> Ini ialah terjemahan [`Credentials`](Credentials). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
@@ -10,8 +10,8 @@ Aliran kerja penyegerakan menggunakan dua rahsia (secret). Beri setiap satu keis
| Secret | Kandungan | Digunakan untuk |
| --- | --- | --- |
| `TOKEN_FOR_GITEA` | Token biasa, rentetan JSON, atau JSON dengan `GITEA_TOKEN` | Membaca repositori (penerangan, topik) dan push mirror-nya |
| `CREDENTIALS_FOR_GITHUB` | Objek JSON dengan `GITHUB_PAT` yang tidak kosong | Mengubah penerangan dan topik cermin GitHub |
| `TOKEN_FOR_GITEA` | Token Gitea, tiada yang lain | Membaca repositori (penerangan, topik) dan push mirror-nya |
| `PAT_FOR_GITHUB` | Token GitHub, tiada yang lain | Mengubah penerangan dan topik cermin GitHub |
## Kebenaran minimum
@@ -33,11 +33,7 @@ Panggilan yang dibuat: `GET /repos/{owner}/{repo}` dan `GET /repos/{owner}/{repo
Panggilan yang dibuat: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (penerangan) dan `PUT /repos/{owner}/{repo}/topics`.
Format `CREDENTIALS_FOR_GITHUB`:
```json
{"GITHUB_PAT": "<token>"}
```
Format `PAT_FOR_GITHUB`: hanya rentetan token (contohnya `github_pat_...`) sebagai teks biasa. Aliran kerja hanya menyemak bahawa ia tidak kosong; GitHub menolak nilai yang salah (HTTP 401).
## Perkara yang disemak oleh aliran kerja sebelum mengubah apa-apa
@@ -56,7 +52,7 @@ Aliran kerja **Publish wiki** (repositori ini sahaja) menyalin `wiki/` ke wiki G
| Secret | Kandungan | Digunakan untuk |
| --- | --- | --- |
| `TOKEN_FOR_GITEA_WIKI` (pilihan) | Token biasa, rentetan JSON, atau JSON dengan `GITEA_TOKEN` | Menulis halaman wiki repositori ini |
| `TOKEN_FOR_GITEA_WIKI` (pilihan) | Token Gitea, tiada yang lain | Menulis halaman wiki repositori ini |
- Token yang digunakan mesti mempunyai skop `write:repository`, dan penggunanya mesti mempunyai akses tulis kepada repositori ini. Gitea tidak mempunyai skop untuk wiki sahaja.
- `TOKEN_FOR_GITEA` didokumenkan di atas dengan `read:repository` sahaja. Menggunakannya semula untuk wiki bermakna meningkatkan skopnya, yang juga memberi akses tulis kepada penyegerakan metadata. `TOKEN_FOR_GITEA_WIKI` yang berasingan untuk pengguna khusus mengekalkan token penyegerakan sebagai baca sahaja. S05 memutuskan yang mana, dan S03 menyimpan secret.
wiki/Home.da.md
+3 -3
View File
@@ -1,4 +1,4 @@
<!-- translation of Home.md, source sha256 75c6a7722bf7 -->
<!-- translation of Home.md, source sha256 59273bf92278 -->
> Dette er en oversættelse af [`Home`](Home). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
@@ -21,8 +21,8 @@ Det indeholder i øjeblikket Gitea-workflowet [`sync-github-metadata.yml`](https
- En Gitea-instans med Actions aktiveret og en runner med labelen `ubuntu-latest` og `python3`
- Et konfigureret GitHub push-spejl på Gitea-repositoryet (højst ét; repositories uden spejl springes over uden fejl)
- Repository-secrets:
- `TOKEN_FOR_GITEA`: Gitea API-token (almindelig tekststreng eller JSON med `GITEA_TOKEN`)
- `CREDENTIALS_FOR_GITHUB`: JSON-objekt med `GITHUB_PAT`, et GitHub personal access token, der må redigere spejl-repositoryet
- `TOKEN_FOR_GITEA`: Gitea API-token (kun tokenet, ingen JSON)
- `PAT_FOR_GITHUB`: et GitHub personal access token, der må redigere spejl-repositoryet (kun tokenet, ingen JSON)
- `TOKEN_FOR_GITEA_WIKI` (valgfri, kun i dette repository, til workflowet **Publish wiki**): Gitea-token, der kan skrive til repositoryets wiki; hvis den mangler, bruges `TOKEN_FOR_GITEA`, som så skal have skriveadgang
wiki/Home.md
+2 -2
View File
@@ -21,8 +21,8 @@ It currently contains the Gitea workflow [`sync-github-metadata.yml`](https://gi
- A Gitea instance with Actions enabled and a runner providing `ubuntu-latest` with `python3`
- A configured GitHub push mirror on the Gitea repository (at most one; repositories without a mirror are skipped successfully)
- Repository secrets:
- `TOKEN_FOR_GITEA`: Gitea API token (plain string, or JSON with `GITEA_TOKEN`)
- `CREDENTIALS_FOR_GITHUB`: JSON object containing `GITHUB_PAT`, a GitHub personal access token allowed to edit the mirror repository
- `TOKEN_FOR_GITEA`: Gitea API token (the token only, no JSON)
- `PAT_FOR_GITHUB`: a GitHub personal access token allowed to edit the mirror repository (the token only, no JSON)
- `TOKEN_FOR_GITEA_WIKI` (optional, only in this repository, for the **Publish wiki** workflow): Gitea token that can write the repository wiki; when it is absent, `TOKEN_FOR_GITEA` is used and needs write access
wiki/Home.ms.md
+3 -3
View File
@@ -1,4 +1,4 @@
<!-- translation of Home.md, source sha256 75c6a7722bf7 -->
<!-- translation of Home.md, source sha256 59273bf92278 -->
> Ini ialah terjemahan [`Home`](Home). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
@@ -21,8 +21,8 @@ Buat masa ini ia mengandungi aliran kerja Gitea [`sync-github-metadata.yml`](htt
- Satu instans Gitea dengan Actions diaktifkan dan satu runner yang menyediakan `ubuntu-latest` dengan `python3`
- Satu push mirror GitHub yang dikonfigurasi pada repositori Gitea (paling banyak satu; repositori tanpa cermin dilangkau dengan jayanya)
- Rahsia (secret) repositori:
- `TOKEN_FOR_GITEA`: token API Gitea (rentetan biasa, atau JSON dengan `GITEA_TOKEN`)
- `CREDENTIALS_FOR_GITHUB`: objek JSON yang mengandungi `GITHUB_PAT`, iaitu personal access token GitHub yang dibenarkan mengubah suai repositori cermin
- `TOKEN_FOR_GITEA`: token API Gitea (token sahaja, tanpa JSON)
- `PAT_FOR_GITHUB`: personal access token GitHub yang dibenarkan mengubah suai repositori cermin (token sahaja, tanpa JSON)
- `TOKEN_FOR_GITEA_WIKI` (pilihan, hanya dalam repositori ini, untuk aliran kerja **Publish wiki**): token Gitea yang boleh menulis ke wiki repositori; jika tiada, `TOKEN_FOR_GITEA` digunakan dan mesti mempunyai akses tulis
wiki/Onboarding.da.md
+2 -2
View File
@@ -1,4 +1,4 @@
<!-- translation of Onboarding.md, source sha256 044127b33c19 -->
<!-- translation of Onboarding.md, source sha256 8e755cad4918 -->
> Dette er en oversættelse af [`Onboarding`](Onboarding). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
@@ -24,7 +24,7 @@ Indtil leveringen er verificeret, tilsluttes et repository ved at kopiere workfl
2. **Konfigurer ét GitHub push-spejl** i repositoryets indstillinger (Settings, Repository, Mirror settings, Push mirror). Workflowet fejler, hvis der er flere GitHub-spejle. Hvis der ingen er, lykkes det uden at synkronisere noget.
3. **Tilføj de to secrets** i repositoryets (eller organisationens) indstillinger med de scopes, der står i [credentials.md](Credentials.da):
- `TOKEN_FOR_GITEA`
- `CREDENTIALS_FOR_GITHUB` (JSON med `GITHUB_PAT`)
- `PAT_FOR_GITHUB` (kun GitHub-tokenet)
4. **Lever workflowet:**
- *Hvis scoped workflows gælder for repositoryet:* der er intet at kopiere.
- *Ellers:* kopier `.gitea/scoped_workflows/sync-github-metadata.yml` fra dette repository til `.gitea/workflows/` i mål-repositoryet. Fastlås kopien til en gennemgået version af dette repository, og kopier igen, når den ændres.
wiki/Onboarding.md
+1 -1
View File
@@ -33,7 +33,7 @@ Until delivery is verified, onboard a repository by copying the workflow (below)
3. **Add the two secrets** in the repository (or organization) settings,
using the scopes in [credentials.md](Credentials):
- `TOKEN_FOR_GITEA`
- `CREDENTIALS_FOR_GITHUB` (JSON with `GITHUB_PAT`)
- `PAT_FOR_GITHUB` (the GitHub token only)
4. **Deliver the workflow:**
- *If scoped workflows apply to the repository:* nothing to copy.
- *Otherwise:* copy `.gitea/scoped_workflows/sync-github-metadata.yml`
wiki/Onboarding.ms.md
+2 -2
View File
@@ -1,4 +1,4 @@
<!-- translation of Onboarding.md, source sha256 044127b33c19 -->
<!-- translation of Onboarding.md, source sha256 8e755cad4918 -->
> Ini ialah terjemahan [`Onboarding`](Onboarding). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
@@ -24,7 +24,7 @@ Selagi penghantaran belum disahkan, sertakan repositori dengan menyalin aliran k
2. **Konfigurasikan satu push mirror GitHub** dalam tetapan repositori (Settings, Repository, Mirror settings, Push mirror). Aliran kerja gagal jika terdapat beberapa cermin GitHub. Jika tiada, ia berjaya tanpa menyegerakkan apa-apa.
3. **Tambah dua rahsia (secret)** dalam tetapan repositori (atau organisasi), dengan skop yang tertera dalam [credentials.md](Credentials.ms):
- `TOKEN_FOR_GITEA`
- `CREDENTIALS_FOR_GITHUB` (JSON dengan `GITHUB_PAT`)
- `PAT_FOR_GITHUB` (token GitHub sahaja)
4. **Hantar aliran kerja:**
- *Jika scoped workflow terpakai pada repositori:* tiada apa yang perlu disalin.
- *Jika tidak:* salin `.gitea/scoped_workflows/sync-github-metadata.yml` dari repositori ini ke `.gitea/workflows/` dalam repositori sasaran. Sematkan salinan itu pada versi repositori ini yang telah disemak, dan salin semula apabila ia berubah.
wiki/Troubleshooting.da.md
+3 -7
View File
@@ -1,4 +1,4 @@
<!-- translation of Troubleshooting.md, source sha256 d34495c26923 -->
<!-- translation of Troubleshooting.md, source sha256 12672b3dde45 -->
> Dette er en oversættelse af [`Troubleshooting`](Troubleshooting). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
@@ -26,12 +26,8 @@ Kategorien fortæller, hvor du skal kigge. En fejl uden for scriptet (jobbet sta
| Meddelelse (begyndelsen) | Kategori | Årsag og løsning |
| --- | --- | --- |
| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Tilføj secreten |
| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | Værdien skal være JSON, fx `{"GITHUB_PAT": "..."}` |
| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Brug et objekt, ikke en liste eller en streng |
| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Tilføj nøglen `GITHUB_PAT` med et token |
| `PAT_FOR_GITHUB is missing or empty.` | configuration | Tilføj secreten |
| `TOKEN_FOR_GITEA is missing or empty.` | configuration | Tilføj secreten |
| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | JSON-formen kræver nøglen `GITEA_TOKEN` |
| `Could not determine the Gitea source repository.` | configuration | Kørslen har intet repositorynavn; meld det som en defekt |
| `Expected at most one GitHub push mirror ... found N` | configuration | Behold ét GitHub push-spejl |
| `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Kun wiki-publicering: tilføj en af secrets (se [credentials.md](Credentials.da)) |
@@ -40,7 +36,7 @@ Kategorien fortæller, hvor du skal kigge. En fejl uden for scriptet (jobbet sta
| `The wiki source directory ... has no Markdown pages` | configuration | Kun wiki-publicering: `wiki/` er tom eller mangler; intet blev ændret |
| `Could not determine the GitHub owner and repository ...` | configuration | Spejlets adresse skal se ud som `https://github.com/<owner>/<repo>.git` |
| `Gitea API request failed with HTTP 401` | credentials | Opret et nyt Gitea-token, og opdatér `TOKEN_FOR_GITEA` |
| `GitHub API request failed with HTTP 401` | credentials | Opret et nyt GitHub-token, og opdatér `CREDENTIALS_FOR_GITHUB` |
| `GitHub API request failed with HTTP 401` | credentials | Opret et nyt GitHub-token, og opdatér `PAT_FOR_GITHUB`; værdien skal kun være tokenet (intet navn, ingen anførselstegn eller JSON) |
| `... HTTP 403 ...` (Gitea) | permissions | Tokenet skal have `read:repository`, og dets bruger skal være administrator af repositoryet |
| `... HTTP 403 ...` (GitHub) | permissions | Tokenet skal have Administration read and write på spejl-repositoryet |
| `The GitHub token cannot administer <repo>` | permissions | Som ovenfor; tokenet kan læse repositoryet, men ikke redigere det |
wiki/Troubleshooting.md
+2 -6
View File
@@ -28,12 +28,8 @@ never starts, or stops before the step) is a **runner** problem.
| Message (start) | Category | Cause and fix |
| --- | --- | --- |
| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | The value must be JSON such as `{"GITHUB_PAT": "..."}` |
| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Use an object, not a list or string |
| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Add the `GITHUB_PAT` key with a token |
| `PAT_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
| `TOKEN_FOR_GITEA is missing or empty.` | configuration | Add the secret |
| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | The JSON form needs a `GITEA_TOKEN` key |
| `Could not determine the Gitea source repository.` | configuration | The run has no repository name; report as a defect |
| `Expected at most one GitHub push mirror ... found N` | configuration | Keep one GitHub push mirror |
| `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Wiki publishing only: add one of the secrets (see [credentials.md](Credentials)) |
@@ -42,7 +38,7 @@ never starts, or stops before the step) is a **runner** problem.
| `The wiki source directory ... has no Markdown pages` | configuration | Wiki publishing only: `wiki/` is empty or missing; nothing was changed |
| `Could not determine the GitHub owner and repository ...` | configuration | The mirror address must look like `https://github.com/<owner>/<repo>.git` |
| `Gitea API request failed with HTTP 401` | credentials | Create a new Gitea token and update `TOKEN_FOR_GITEA` |
| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `CREDENTIALS_FOR_GITHUB` |
| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `PAT_FOR_GITHUB`; the value must be the token only (no name, quotes or JSON) |
| `... HTTP 403 ...` (Gitea) | permissions | Token needs `read:repository`, and its user needs administrator access to the repository |
| `... HTTP 403 ...` (GitHub) | permissions | Token needs Administration read and write on the mirror repository |
| `The GitHub token cannot administer <repo>` | permissions | Same as above; the token can read the repository but not edit it |
wiki/Troubleshooting.ms.md
+3 -7
View File
@@ -1,4 +1,4 @@
<!-- translation of Troubleshooting.md, source sha256 d34495c26923 -->
<!-- translation of Troubleshooting.md, source sha256 12672b3dde45 -->
> Ini ialah terjemahan [`Troubleshooting`](Troubleshooting). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
@@ -26,12 +26,8 @@ Kategori menunjukkan di mana perlu dilihat. Kegagalan di luar skrip (kerja tidak
| Mesej (permulaan) | Kategori | Punca dan pembetulan |
| --- | --- | --- |
| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Tambah secret |
| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | Nilai mesti JSON seperti `{"GITHUB_PAT": "..."}` |
| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Gunakan objek, bukan senarai atau rentetan |
| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Tambah kunci `GITHUB_PAT` dengan token |
| `PAT_FOR_GITHUB is missing or empty.` | configuration | Tambah secret |
| `TOKEN_FOR_GITEA is missing or empty.` | configuration | Tambah secret |
| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | Bentuk JSON memerlukan kunci `GITEA_TOKEN` |
| `Could not determine the Gitea source repository.` | configuration | Larian tiada nama repositori; laporkan sebagai kecacatan |
| `Expected at most one GitHub push mirror ... found N` | configuration | Kekalkan satu push mirror GitHub |
| `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Penerbitan wiki sahaja: tambah salah satu secret (lihat [credentials.md](Credentials.ms)) |
@@ -40,7 +36,7 @@ Kategori menunjukkan di mana perlu dilihat. Kegagalan di luar skrip (kerja tidak
| `The wiki source directory ... has no Markdown pages` | configuration | Penerbitan wiki sahaja: `wiki/` kosong atau tiada; tiada apa-apa diubah |
| `Could not determine the GitHub owner and repository ...` | configuration | Alamat cermin mesti kelihatan seperti `https://github.com/<owner>/<repo>.git` |
| `Gitea API request failed with HTTP 401` | credentials | Cipta token Gitea baharu dan kemas kini `TOKEN_FOR_GITEA` |
| `GitHub API request failed with HTTP 401` | credentials | Cipta token GitHub baharu dan kemas kini `CREDENTIALS_FOR_GITHUB` |
| `GitHub API request failed with HTTP 401` | credentials | Cipta token GitHub baharu dan kemas kini `PAT_FOR_GITHUB`; nilai mesti token sahaja (tiada nama, tanda petikan atau JSON) |
| `... HTTP 403 ...` (Gitea) | permissions | Token memerlukan `read:repository`, dan penggunanya mesti pentadbir repositori |
| `... HTTP 403 ...` (GitHub) | permissions | Token memerlukan Administration read and write pada repositori cermin |
| `The GitHub token cannot administer <repo>` | permissions | Sama seperti di atas; token boleh membaca repositori tetapi tidak boleh mengeditnya |