From a136853126b19ce0edc859e02630489e0ca94710 Mon Sep 17 00:00:00 2001 From: Latte Date: Sat, 27 Jun 2026 17:52:14 +0200 Subject: [PATCH] ci: grant contents:read so publish can checkout private repo Setting `permissions: packages: write` alone dropped every other scope to none, so actions/checkout could not clone the private repo and the publish job failed before building. Add contents:read, and use github.actor (more reliably populated than gitea.actor) as the twine username. Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 32ca8df..4fb9861 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -42,6 +42,7 @@ jobs: needs: [lint, test] runs-on: ubuntu-latest permissions: + contents: read # needed for checkout of the private repo packages: write steps: - uses: actions/checkout@v4 @@ -70,7 +71,7 @@ jobs: env: # The auto-provided token works for the same owner's package registry. # Override with a PACKAGE_REGISTRY_TOKEN secret if your instance needs it. - TWINE_USERNAME: ${{ gitea.actor }} + TWINE_USERNAME: ${{ github.actor }} TWINE_PASSWORD: ${{ secrets.PACKAGE_REGISTRY_TOKEN || secrets.GITHUB_TOKEN }} run: | uvx twine upload \