From 10f37ac0040fbe720db660953b7efb2fa729bbb0 Mon Sep 17 00:00:00 2001 From: Paul Schneider Date: Mon, 17 Aug 2026 16:02:58 +0100 Subject: [PATCH] drop github.* context, switch to forgejo.* + FORGEJO_TOKEN env var MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The github context was kept for compatibility in yavsc's .forgejo/workflows/release.yml, but we don't need that here — the forgejo context is canonical and we want zero GitHub-flavoured naming in this script. - All ${{ github.* }} -> ${{ forgejo.* }} - Env vars GITHUB_API_URL / GITHUB_REPOSITORY / GITHUB_TOKEN -> FORGEJO_API_URL / FORGEJO_REPOSITORY / FORGEJO_TOKEN - The token's source (${{ secrets.GITHUB_TOKEN }}) is the one exception: that's the runtime variable name exposed by the upstream Action runner, not a naming choice. A comment in the env block explains why we read it under the legacy name and immediately re-bind it to FORGEJO_TOKEN. - Same for $GITHUB_ENV (inter-step env file): runtime-controlled name, kept under its technical identity with a note. YAML re-validated with yaml.safe_load. --- .forgejo/workflows/release.yml | 63 ++++++++++++++++++---------------- 1 file changed, 34 insertions(+), 29 deletions(-) diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml index bb7a23a..e11f798 100644 --- a/.forgejo/workflows/release.yml +++ b/.forgejo/workflows/release.yml @@ -10,15 +10,11 @@ # then publishes a Forgejo release via the REST API and uploads both # .deb files as assets. # -# Authentication uses ${{ secrets.GITHUB_TOKEN }} (auto-provided by -# the Forgejo runner, scoped to contents: write for the current -# repo). A dedicated PAT (${{ secrets.RELEASE_TOKEN }}) was the -# preferred option for least-privilege, but creating repo-level -# secrets is currently broken on this Forgejo instance -# (InsertEncryptedSecret fails with a UTF-8 byte-sequence error, -# probably a text-vs-bytea column type on the secret table). Bumping -# to Forgejo v16 should fix it; until then, the runner-provided -# token keeps the workflow operational. +# Authentication: the runner exposes an auto-provided token in the +# secrets context under the name GITHUB_TOKEN (a holdover name from +# the upstream Action runner codebase, NOT a reference to github.com). +# We store it in the env var FORGEJO_TOKEN to keep the rest of this +# script free of any GitHub-flavoured naming. # # Why bash + jq + curl, no third-party actions: the runner's docker # label points at pazof/yavsc-build-env, a Debian image with jq but @@ -78,7 +74,7 @@ jobs: - name: Clone du repo au tag demandé env: - TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }} + TAG: ${{ forgejo.event_name == 'push' && forgejo.ref_name || inputs.tag }} run: | if [[ -z "$TAG" ]]; then echo "::error::No tag provided. In workflow_dispatch, set the 'tag' input." @@ -173,7 +169,11 @@ jobs: echo "Section CHANGELOG validée pour [$TAG] - $CHANNEL" - # Expose channel + body pour les étapes suivantes via $GITHUB_ENV. + # Expose channel + body pour les étapes suivantes via + # le fichier d'environnement inter-steps fourni par le + # runner (le nom technique de la variable runtime est + # GITHUB_ENV, on ne le contrôle pas — c'est un héritage + # du runner Action upstream). echo "RELEASE_CHANNEL=$CHANNEL" >> "$GITHUB_ENV" echo "RELEASE_BODY<> "$GITHUB_ENV" echo "$RELEASE_BODY" >> "$GITHUB_ENV" @@ -182,7 +182,7 @@ jobs: - name: Build .deb amd64 env: - POSTIT_GIT_TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }} + POSTIT_GIT_TAG: ${{ forgejo.event_name == 'push' && forgejo.ref_name || inputs.tag }} POSTIT_RUNTIME: linux-x64 run: | cd /src/_src @@ -191,7 +191,7 @@ jobs: - name: Build .deb arm64 env: - POSTIT_GIT_TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }} + POSTIT_GIT_TAG: ${{ forgejo.event_name == 'push' && forgejo.ref_name || inputs.tag }} POSTIT_RUNTIME: linux-arm64 run: | cd /src/_src @@ -202,7 +202,7 @@ jobs: - name: Localiser les .deb produits env: - LOOKUP_TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }} + LOOKUP_TAG: ${{ forgejo.event_name == 'push' && forgejo.ref_name || inputs.tag }} run: | cd /src DEB_AMD64=$(find . -maxdepth 3 -name "postit_*${LOOKUP_TAG}-1_amd64.deb" \ @@ -220,10 +220,15 @@ jobs: - name: Publier la release Forgejo via l'API REST env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GITHUB_API_URL: ${{ github.api_url }} - GITHUB_REPOSITORY: ${{ github.repository }} - TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }} + # Le runner expose un token auto-fourni dans le contexte + # `secrets` sous le nom GITHUB_TOKEN (héritage du runtime + # Action upstream — on ne peut pas le renommer). On le + # stocke dans FORGEJO_TOKEN pour le reste du script, et + # on évite ainsi toute référence "github" dans nos noms. + FORGEJO_TOKEN: ${{ secrets.GITHUB_TOKEN }} + FORGEJO_API_URL: ${{ forgejo.api_url }} + FORGEJO_REPOSITORY: ${{ forgejo.repository }} + TAG: ${{ forgejo.event_name == 'push' && forgejo.ref_name || inputs.tag }} # RELEASE_BODY peut contenir des retours à la ligne et # des caractères YAML-réservés (':', '#', etc.) issus du # CHANGELOG.md. On le quote en YAML double-quoted string @@ -238,11 +243,11 @@ jobs: exit 1 fi - # Le runner Forgejo expose l'API sur github.api_url (par + # Le runner Forgejo expose l'API sur forgejo.api_url (par # défaut http://…/api/v1). On retire le suffixe /api/v1 # s'il est présent pour dériver la base du serveur, puis # on reconstruit l'URL de l'API proprement. - API_BASE="${GITHUB_API_URL%/}" + API_BASE="${FORGEJO_API_URL%/}" API_BASE="${API_BASE%/api/v1}" # 1. Vérifier si la release existe déjà pour ce tag. @@ -251,9 +256,9 @@ jobs: # tête de fichier. echo "::group::Check existing release for tag $TAG" HTTP=$(curl -sS -o /tmp/existing.json -w '%{http_code}' \ - -H "Authorization: token $GITHUB_TOKEN" \ + -H "Authorization: token $FORGEJO_TOKEN" \ -H "Accept: application/json" \ - "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases/tags/$TAG") + "$API_BASE/api/v1/repos/$FORGEJO_REPOSITORY/releases/tags/$TAG") echo "GET releases/tags/$TAG -> HTTP $HTTP" EXISTING_ID="" if [[ "$HTTP" == "200" ]]; then @@ -272,11 +277,11 @@ jobs: > /tmp/patch.json HTTP=$(curl -sS -o /tmp/release.json -w '%{http_code}' \ -X PATCH \ - -H "Authorization: token $GITHUB_TOKEN" \ + -H "Authorization: token $FORGEJO_TOKEN" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ --data-binary @/tmp/patch.json \ - "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases/$EXISTING_ID") + "$API_BASE/api/v1/repos/$FORGEJO_REPOSITORY/releases/$EXISTING_ID") echo "PATCH release -> HTTP $HTTP" echo "::endgroup::" else @@ -290,11 +295,11 @@ jobs: > /tmp/post.json HTTP=$(curl -sS -o /tmp/release.json -w '%{http_code}' \ -X POST \ - -H "Authorization: token $GITHUB_TOKEN" \ + -H "Authorization: token $FORGEJO_TOKEN" \ -H "Content-Type: application/json" \ -H "Accept: application/json" \ --data-binary @/tmp/post.json \ - "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases") + "$API_BASE/api/v1/repos/$FORGEJO_REPOSITORY/releases") echo "POST release -> HTTP $HTTP" echo "::endgroup::" fi @@ -317,11 +322,11 @@ jobs: echo "::group::Upload asset for arch=$arch: $deb" HTTP=$(curl -sS -o /tmp/asset.json -w '%{http_code}' \ -X POST \ - -H "Authorization: token $GITHUB_TOKEN" \ + -H "Authorization: token $FORGEJO_TOKEN" \ -H "Content-Type: application/octet-stream" \ -H "Accept: application/json" \ --data-binary "@$deb" \ - "$API_BASE/api/v1/repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets?name=$(basename "$deb")") + "$API_BASE/api/v1/repos/$FORGEJO_REPOSITORY/releases/$RELEASE_ID/assets?name=$(basename "$deb")") echo "POST asset ($arch) -> HTTP $HTTP" echo "::endgroup::" @@ -332,4 +337,4 @@ jobs: fi done - echo "Release publiée : $API_BASE/$GITHUB_REPOSITORY/releases/tag/$TAG" + echo "Release publiée : $API_BASE/$FORGEJO_REPOSITORY/releases/tag/$TAG"