ci: push docs-regen commit with a real account token, not the default bot

The default `secrets.GITEA_TOKEN` is Gitea Actions' built-in synthetic bot identity, not a whitelistable user account. main's branch protection rejects its pushes outright regardless of retries (run 983, run 990) -- the retry/rebase loop in the next step was built for a non-fast-forward race (run 976), not a bare permission rejection, so it can't recover from this. Point the docs job's checkout token at BOT_PUSH_TOKEN, a PAT on the already-bypass-whitelisted rootiest account, so the later push succeeds. Commit authorship and GPG signing (fishconfig-bot) are set separately via git config a few steps later and are unaffected -- push auth and commit identity are independent.
2026-09-23 18:50:30 -04:00
parent 27b6f5d263
commit 028478940f
1 changed files with 9 additions and 1 deletions
@@ -138,7 +138,15 @@ jobs:
      - name: Checkout
        uses: actions/checkout@v4
        with:
-          token: ${{ secrets.GITEA_TOKEN }}
+          # The default GITEA_TOKEN is Gitea Actions' built-in synthetic
+          # bot identity, not a real account -- main's branch protection
+          # rejects its pushes outright (run 983, run 990), and it can't
+          # be whitelisted because it isn't an addable user. BOT_PUSH_TOKEN
+          # is a PAT on the rootiest account (already bypass-whitelisted)
+          # used only so this job's later push succeeds; commit authorship
+          # and GPG signing below still use the fishconfig-bot identity,
+          # which is unrelated to push auth.
+          token: ${{ secrets.BOT_PUSH_TOKEN }}
          fetch-depth: 0

      # Same shape as the test job's identical step; see its comment.