fix(ci): add the Bearer prefix in the workflow, not in the secret #5

Merged

iuriishikov merged 1 commit from fix/bearer-in-workflow into main

2026-08-20 00:48:45 +00:00

iuriishikov commented

2026-08-20 00:48:36 +00:00

Owner

The Bearer prefix is how cargo's token reaches Forgejo — a detail of the protocol, not a property of the token. Stored inside a write-only secret it cannot be seen or reviewed, and its absence shows up only as a 401 whose body reads authGroup.Verify. The first release lost a round to exactly that.

With the prefix here the secrets hold bare tokens, the shape is identical across every repository because it travels from the template, and forgetting it is no longer possible.

Coordination required: both CRATES_READ_TOKEN and CRATES_WRITE_TOKEN must be rewritten without the prefix when this lands — carrying it in both places sends Bearer Bearer ….

Departs from the letter of ADR-018, which puts the prefix in the secret; the amendment gets a line saying why.

The `Bearer ` prefix is how cargo's token reaches Forgejo — a detail of the protocol, not a property of the token. Stored inside a write-only secret it cannot be seen or reviewed, and its absence shows up only as a `401` whose body reads `authGroup.Verify`. The first release lost a round to exactly that. With the prefix here the secrets hold bare tokens, the shape is identical across every repository because it travels from the template, and forgetting it is no longer possible. **Coordination required:** both `CRATES_READ_TOKEN` and `CRATES_WRITE_TOKEN` must be rewritten *without* the prefix when this lands — carrying it in both places sends `Bearer Bearer …`. Departs from the letter of ADR-018, which puts the prefix in the secret; the amendment gets a line saying why.

iuriishikov added 1 commit

2026-08-20 00:48:37 +00:00

fix(ci): add the Bearer prefix in the workflow, not in the secret

smoke / smoke (push) Successful in 28s

Details

60f5cd4a50

The prefix is how cargo's token reaches Forgejo — a detail of the protocol, not
a property of the token. Stored inside a write-only secret it cannot be seen or
reviewed, and its absence shows up only as a 401 whose body reads
authGroup.Verify. The first release lost a round to exactly that.

With the prefix here the secrets hold bare tokens, the shape is identical across
every repository because it travels from the template, and forgetting it is no
longer possible.

Both secrets must be rewritten without the prefix when this lands: carrying it
in both places would send 'Bearer Bearer …'.

iuriishikov merged commit 15ac4206eb into main

2026-08-20 00:48:45 +00:00

iuriishikov deleted branch fix/bearer-in-workflow

2026-08-20 00:48:45 +00:00

iuriishikov referenced this pull request from a commit

2026-08-20 00:48:47 +00:00

fix(ci): add the Bearer prefix in the workflow, not in the secret (#5)