From 028478940f585fe1a565e6a894300c880ef54e5b Mon Sep 17 00:00:00 2001 From: Rootiest Date: Wed, 23 Sep 2026 18:50:30 -0400 Subject: [PATCH] ci: push docs-regen commit with a real account token, not the default bot The default `secrets.GITEA_TOKEN` is Gitea Actions' built-in synthetic bot identity, not a whitelistable user account. main's branch protection rejects its pushes outright regardless of retries (run 983, run 990) -- the retry/rebase loop in the next step was built for a non-fast-forward race (run 976), not a bare permission rejection, so it can't recover from this. Point the docs job's checkout token at BOT_PUSH_TOKEN, a PAT on the already-bypass-whitelisted rootiest account, so the later push succeeds. Commit authorship and GPG signing (fishconfig-bot) are set separately via git config a few steps later and are unaffected -- push auth and commit identity are independent. --- .github/workflows/ci.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c1ccc96..876b019 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -138,7 +138,15 @@ jobs: - name: Checkout uses: actions/checkout@v4 with: - token: ${{ secrets.GITEA_TOKEN }} + # The default GITEA_TOKEN is Gitea Actions' built-in synthetic + # bot identity, not a real account -- main's branch protection + # rejects its pushes outright (run 983, run 990), and it can't + # be whitelisted because it isn't an addable user. BOT_PUSH_TOKEN + # is a PAT on the rootiest account (already bypass-whitelisted) + # used only so this job's later push succeeds; commit authorship + # and GPG signing below still use the fishconfig-bot identity, + # which is unrelated to push auth. + token: ${{ secrets.BOT_PUSH_TOKEN }} fetch-depth: 0 # Same shape as the test job's identical step; see its comment.