From 3e46b08db5fdef3270c8bdf6831f432bcce4ec00 Mon Sep 17 00:00:00 2001 From: byrsapty Date: Wed, 22 Jul 2026 21:42:36 +0300 Subject: [PATCH] CI: authenticate the deploy clone so it keeps working once the repo is private Forgejo auto-issues a per-job, repo-scoped secrets.GITHUB_TOKEN (created at workflow start, destroyed at completion, usable only against this repo); use it in the clone URL instead of an anonymous HTTPS clone, which would start failing with 401/403 the moment the repo's visibility changes. Co-Authored-By: Claude Sonnet 5 --- .forgejo/workflows/deploy.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml index 0fdc5ec..763acf4 100644 --- a/.forgejo/workflows/deploy.yml +++ b/.forgejo/workflows/deploy.yml @@ -15,9 +15,13 @@ jobs: GRAYLOG_EXTERNAL_URI: http://93.171.241.5:9000/ GRAYLOG_ADMIN_PASSWORD: ${{ secrets.GRAYLOG_ADMIN_PASSWORD }} DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }} + # Forgejo issues this automatically per-job, scoped to this repo only - + # needed once the repo is private, since a plain anonymous clone would + # get 401/403. No extra secret to manage: it's provided by the platform. + CI_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | rm -rf /tmp/graylog-deploy-ci - git clone --depth 1 --branch main https://git.zotac.keenetic.link/zotac/graylog-deploy.git /tmp/graylog-deploy-ci + git clone --depth 1 --branch main "https://x-access-token:${CI_TOKEN}@git.zotac.keenetic.link/zotac/graylog-deploy.git" /tmp/graylog-deploy-ci cd /tmp/graylog-deploy-ci chmod +x install-graylog.sh ./install-graylog.sh