fix(ci): push the changelog as a whitelisted bot, not the Actions identity

rcsheets commented

2026-08-05 08:22:05 +00:00

Owner

secrets.FORGEJO_TOKEN is not a secret this repo forgot to create -- the
FORGEJO_ prefix is reserved (as are GITEA_ and GITHUB_), so no secret can
exist under that name. It resolves instead to the runner's built-in
Actions identity, uid -2.

That is fine for the three steps that only clone or read tags, and it is
why they work today. It is not fine for the changelog, which pushes to
main: a protected branch whitelists accounts, and uid -2 is not one. The
pre-receive hook cannot resolve it to a user at all, which is why the
refusal arrived as "Internal Server Error (no message for end users)"
instead of naming the protection -- the same opaque 500 seen on v0.30.0
through v0.33.1.

Only the changelog step moves, to CI_BOT_TOKEN, held by
ci-brooktrails-gllm-bot, which is now on main's push whitelist. The
checkout and tag pushes keep the built-in identity deliberately: they
work, and repointing them at a secret would make the whole job depend on
it being present.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

secrets.FORGEJO_TOKEN is not a secret this repo forgot to create -- the FORGEJO_ prefix is reserved (as are GITEA_ and GITHUB_), so no secret can exist under that name. It resolves instead to the runner's built-in Actions identity, uid -2. That is fine for the three steps that only clone or read tags, and it is why they work today. It is not fine for the changelog, which pushes to main: a protected branch whitelists accounts, and uid -2 is not one. The pre-receive hook cannot resolve it to a user at all, which is why the refusal arrived as "Internal Server Error (no message for end users)" instead of naming the protection -- the same opaque 500 seen on v0.30.0 through v0.33.1. Only the changelog step moves, to CI_BOT_TOKEN, held by ci-brooktrails-gllm-bot, which is now on main's push whitelist. The checkout and tag pushes keep the built-in identity deliberately: they work, and repointing them at a secret would make the whole job depend on it being present. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rcsheets added 1 commit

2026-08-05 08:22:06 +00:00

fix(ci): push the changelog as a whitelisted bot, not the Actions identity

ci / test_and_build (pull_request) Successful in 22s

Details

c4056661bc

secrets.FORGEJO_TOKEN is not a secret this repo forgot to create -- the
FORGEJO_ prefix is reserved (as are GITEA_ and GITHUB_), so no secret can
exist under that name. It resolves instead to the runner's built-in
Actions identity, uid -2.

That is fine for the three steps that only clone or read tags, and it is
why they work today. It is not fine for the changelog, which pushes to
main: a protected branch whitelists accounts, and uid -2 is not one. The
pre-receive hook cannot resolve it to a user at all, which is why the
refusal arrived as "Internal Server Error (no message for end users)"
instead of naming the protection -- the same opaque 500 seen on v0.30.0
through v0.33.1.

Only the changelog step moves, to CI_BOT_TOKEN, held by
ci-brooktrails-gllm-bot, which is now on main's push whitelist. The
checkout and tag pushes keep the built-in identity deliberately: they
work, and repointing them at a secret would make the whole job depend on
it being present.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

pr-reviewer-bot commented

2026-08-05 08:22:07 +00:00

Collaborator

Automated review by pr-reviewer v0.44.2 | Safety Check | Claude Sonnet 5 | tracking id r-72f2af-bbd424
This is an AI-generated review and may contain mistakes.

Status: ✅ Completed

⚠️ The primary review (Mistral Small) failed. The review below is from Claude Sonnet 5, which reviewed the same diff.

✅ Verdict: LGTM — The diff only swaps a secret reference used for authenticating a changelog push step; no literal credentials are exposed and the change is narrowly scoped as described.

The change swaps secrets.FORGEJO_TOKEN for secrets.CI_BOT_TOKEN in a single step, referencing a secret via the standard Actions/Forgejo secrets.* interpolation — this is not a literal exposed credential, just a reference to a secret presumably already configured in the repo's CI settings. The "possible secret detected" flag is a false positive from the automated scanner, likely triggered by the word "token" and the explanatory comment discussing token/secret resolution behavior.

The change itself is small, well-scoped, and the reasoning in the PR description (reserved secret prefixes resolving to the built-in Actions identity, which can't be whitelisted on a protected branch) is coherent and plausible. Only the changelog-push step is touched; checkout/tag steps are left alone as stated. No logic bugs, no breaking changes beyond the intended fix, no committed credentials.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.44.2 | Safety Check | Claude Sonnet 5 | tracking id `r-72f2af-bbd424`* *This is an AI-generated review and may contain mistakes.* **Status:** ✅ Completed --- > ⚠️ The primary review (**Mistral Small**) failed. The review below is from **Claude Sonnet 5**, which reviewed the same diff. **✅ Verdict: LGTM** — The diff only swaps a secret reference used for authenticating a changelog push step; no literal credentials are exposed and the change is narrowly scoped as described. The change swaps `secrets.FORGEJO_TOKEN` for `secrets.CI_BOT_TOKEN` in a single step, referencing a secret via the standard Actions/Forgejo `secrets.*` interpolation — this is not a literal exposed credential, just a reference to a secret presumably already configured in the repo's CI settings. The "possible secret detected" flag is a false positive from the automated scanner, likely triggered by the word "token" and the explanatory comment discussing token/secret resolution behavior. The change itself is small, well-scoped, and the reasoning in the PR description (reserved secret prefixes resolving to the built-in Actions identity, which can't be whitelisted on a protected branch) is coherent and plausible. Only the changelog-push step is touched; checkout/tag steps are left alone as stated. No logic bugs, no breaking changes beyond the intended fix, no committed credentials.

rcsheets merged commit cfeb3beaa0 into main

2026-08-05 08:24:16 +00:00

rcsheets deleted branch fix/changelog-bot-token

2026-08-05 08:24:17 +00:00

rcsheets referenced this pull request from a commit

2026-08-05 08:24:18 +00:00

Merge pull request 'fix(ci): push the changelog as a whitelisted bot, not the Actions identity' (#62) from fix/changelog-bot-token into main

Rows
Columns

fix(ci): push the changelog as a whitelisted bot, not the Actions identity #62