ci: push docs-regen commit with a real account token, not the default bot #176

2026-09-23T22:50:55Z

rootiest commented

2026-09-23 22:50:55 +00:00

The default secrets.GITEA_TOKEN is Gitea Actions' built-in synthetic bot identity, not a whitelistable user account. main's branch protection rejects its pushes outright regardless of retries (run 983, run 990) — the retry/rebase loop in the next step was built for a non-fast-forward race (run 976), not a bare permission rejection, so it can't recover from this.

Points the docs job's checkout token at BOT_PUSH_TOKEN, a PAT on the already-bypass-whitelisted rootiest account, so the later push succeeds. Commit authorship and GPG signing (fishconfig-bot) are set separately via git config a few steps later and are unaffected — push auth and commit identity are independent.

Fixes the recurring docs job failure at "Commit generated docs" on every push to main that touches generated docs.

The default `secrets.GITEA_TOKEN` is Gitea Actions' built-in synthetic bot identity, not a whitelistable user account. main's branch protection rejects its pushes outright regardless of retries (run 983, run 990) — the retry/rebase loop in the next step was built for a non-fast-forward race (run 976), not a bare permission rejection, so it can't recover from this. Points the docs job's checkout token at `BOT_PUSH_TOKEN`, a PAT on the already-bypass-whitelisted `rootiest` account, so the later push succeeds. Commit authorship and GPG signing (`fishconfig-bot`) are set separately via `git config` a few steps later and are unaffected — push auth and commit identity are independent. Fixes the recurring `docs` job failure at "Commit generated docs" on every push to main that touches generated docs.

rootiest added 1 commit 2026-09-23 22:51:00 +00:00

ci: push docs-regen commit with a real account token, not the default bot

CI / test (pull_request) Successful in 2m40s

Details

CI / github-mirror (pull_request) Skipped

Details

CI / docs (pull_request) Successful in 20s

Details

028478940f

The default `secrets.GITEA_TOKEN` is Gitea Actions' built-in synthetic
bot identity, not a whitelistable user account. main's branch protection
rejects its pushes outright regardless of retries (run 983, run 990) --
the retry/rebase loop in the next step was built for a non-fast-forward
race (run 976), not a bare permission rejection, so it can't recover
from this.

Point the docs job's checkout token at BOT_PUSH_TOKEN, a PAT on the
already-bypass-whitelisted rootiest account, so the later push
succeeds. Commit authorship and GPG signing (fishconfig-bot) are set
separately via git config a few steps later and are unaffected -- push
auth and commit identity are independent.

rootiest added the Area/CI Kind/Bug labels 2026-09-23 22:51:32 +00:00

rootiest merged commit c48af2fa23 into main

2026-09-23 22:55:13 +00:00

rootiest deleted branch ci/bot-push-token

2026-09-23 22:55:13 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rootiest/fish-config#176