raulrgmx/oci-deal-accelerator
1
0
Fork 0
forked from diegoecab/oci-deal-accelerator
Code Pull Requests Activity

Use auto-provisioned GITHUB_TOKEN in SKU refresh workflow

Browse Source 
Switch from manually-configured secrets.GITEA_TOKEN to the auto-provisioned
secrets.GITHUB_TOKEN that Gitea Actions creates per run. Scoped to the repo,
rotates per workflow run, no manual config needed.

Added explicit permissions block (contents:write, pull-requests:write,
issues:write) so the ephemeral token has the scopes required to push a
branch, open the PR, and open the issue for new SKUs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
root
2026-04-24 11:51:00 -03:00
parent 874d40d38a
commit 433b08071b
1 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
.gitea/workflows/sku-catalog-refresh.yaml
View File

@@ -11,10 +11,11 @@
# If new SKUs are found, opens a Gitea issue listing them by category # If new SKUs are found, opens a Gitea issue listing them by category
# for manual review. # for manual review.
# #
# Tokens: # Token:
# secrets.GITEA_TOKEN — must have repo:write + issues:write. # Uses the auto-provisioned secrets.GITHUB_TOKEN (Gitea Actions provides this
# If not set, the run logs the diff/discover output as an artifact and # per-run, scoped to this repo, GitHub-Actions-compatible). No manual secret
# leaves the rest (branch push, PR, issue) as a no-op. # configuration required. The explicit `permissions:` block below grants the
# scopes needed to push a branch, open a PR, and open an issue.
name: SKU Catalog Refresh name: SKU Catalog Refresh
on: on:
@@ -22,6 +23,11 @@ on:
- cron: '0 9 1 * *' - cron: '0 9 1 * *'
workflow_dispatch: workflow_dispatch:
permissions:
contents: write
pull-requests: write
issues: write
jobs: jobs:
refresh-and-discover: refresh-and-discover:
runs-on: ubuntu-latest runs-on: ubuntu-latest
@@ -70,9 +76,9 @@ jobs:
retention-days: 90 retention-days: 90
- name: Open PR with price updates - name: Open PR with price updates
if: steps.refresh.outputs.changed == 'true' && env.GITEA_TOKEN != '' if: steps.refresh.outputs.changed == 'true'
env: env:
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITEA_SERVER: ${{ github.server_url }} GITEA_SERVER: ${{ github.server_url }}
GITEA_REPO: ${{ github.repository }} GITEA_REPO: ${{ github.repository }}
run: | run: |
@@ -109,9 +115,9 @@ jobs:
'{title:$title, head:$head, base:$base, body:$body}')" '{title:$title, head:$head, base:$base, body:$body}')"
- name: Open issue for new SKUs - name: Open issue for new SKUs
if: steps.discover.outputs.new_count != '0' && env.GITEA_TOKEN != '' if: steps.discover.outputs.new_count != '0'
env: env:
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITEA_SERVER: ${{ github.server_url }} GITEA_SERVER: ${{ github.server_url }}
GITEA_REPO: ${{ github.repository }} GITEA_REPO: ${{ github.repository }}
NEW_COUNT: ${{ steps.discover.outputs.new_count }} NEW_COUNT: ${{ steps.discover.outputs.new_count }}
@@ -138,6 +144,3 @@ jobs:
echo "## SKU Refresh Summary" >> $GITHUB_STEP_SUMMARY echo "## SKU Refresh Summary" >> $GITHUB_STEP_SUMMARY
echo "- Catalog changed: ${{ steps.refresh.outputs.changed }}" >> $GITHUB_STEP_SUMMARY echo "- Catalog changed: ${{ steps.refresh.outputs.changed }}" >> $GITHUB_STEP_SUMMARY
echo "- New SKUs discovered: ${{ steps.discover.outputs.new_count }}" >> $GITHUB_STEP_SUMMARY echo "- New SKUs discovered: ${{ steps.discover.outputs.new_count }}" >> $GITHUB_STEP_SUMMARY
echo "- Token configured: ${{ env.GITEA_TOKEN != '' && 'yes' || 'no (PR/issue skipped)' }}" >> $GITHUB_STEP_SUMMARY
env:
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}