fix(ci): let the gate reach our own registry, and record how secrets travel #4

Merged

iuriishikov merged 1 commit from fix/secrets-inherit into main

2026-08-20 00:17:41 +00:00

iuriishikov commented

2026-08-20 00:17:32 +00:00

Owner

The first release failed with a 401 whose body is reqPackageAccess — the same answer the registry gives a request carrying no Authorization header, and distinct from authGroup.Verify, which is what a malformed token gets. Both were probed against the live endpoint to tell them apart. cargo had the token variable set, but empty, so it sent an empty header and the server read the request as anonymous.

Cause: organisation secrets do not reach a called workflow on their own, while organisation variables do — the job had already pulled its container image through vars.REGISTRY before failing. The caller must pass them with secrets: inherit (supported: Job.InheritSecrets in Forgejo's act fork), and the callee's workflow_call block must stay empty, or Forgejo runs it on every push.

rust-ci.yml gains the same wiring for the read token. It needs none today and will need it the moment one of our crates depends on another — better to have it in place than to discover it on the next release.

The first release failed with a 401 whose body is `reqPackageAccess` — the same answer the registry gives a request carrying **no** `Authorization` header, and distinct from `authGroup.Verify`, which is what a malformed token gets. Both were probed against the live endpoint to tell them apart. cargo had the token variable set, but empty, so it sent an empty header and the server read the request as anonymous. Cause: organisation **secrets** do not reach a called workflow on their own, while organisation **variables** do — the job had already pulled its container image through `vars.REGISTRY` before failing. The caller must pass them with `secrets: inherit` (supported: `Job.InheritSecrets` in Forgejo's act fork), and the callee's `workflow_call` block must stay empty, or Forgejo runs it on every push. `rust-ci.yml` gains the same wiring for the read token. It needs none today and will need it the moment one of our crates depends on another — better to have it in place than to discover it on the next release.

iuriishikov added 1 commit

2026-08-20 00:17:32 +00:00

fix(ci): let the gate reach our own registry, and record how secrets travel

smoke / smoke (push) Successful in 24s

Details

2fc4222d93

The first release failed on a 401 the registry reports as reqPackageAccess —
the same answer it gives a request carrying no Authorization header at all, and
distinct from authGroup.Verify, which is what a malformed token gets. cargo had
a token variable, but it was empty, so it sent an empty header.

Cause: organisation secrets do not reach a called workflow on their own, while
organisation variables do — this job had already pulled its container image
through vars.REGISTRY before failing. The caller has to pass them, and the
callee's workflow_call block must stay empty or Forgejo runs it on every push.

The gate gains the same wiring for the read token: it needs none today and will
need it the moment one of our crates depends on another.

iuriishikov merged commit b0a6314488 into main

2026-08-20 00:17:41 +00:00

iuriishikov deleted branch fix/secrets-inherit

2026-08-20 00:17:41 +00:00

iuriishikov referenced this pull request from a commit

2026-08-20 00:17:42 +00:00

fix(ci): let the gate reach our own registry, and record how secrets travel (#4)