ci: ask for CI_TOKEN, the name the other two sibling checkouts use #138

Merged

peterswimm merged 1 commit from ci/gutenberg-block-validation into main

2026-09-14 19:08:00 +00:00

peterswimm commented

2026-09-14 19:07:46 +00:00

Owner

Follow-up to #137. The gate landed asking for FORGEJO_TOKEN; this points it at CI_TOKEN, so one secret serves all three jobs that check out the private sibling.

What the runs on #137 established:

FORGEJO_TOKEN is supplied to the job — the error moved past "Input required and not supplied" — but checkout then reports "The target couldn't be found" for Toilville/toilville_rituals. It cannot read repositories; its twelve uses in the Rituals workflows are releases, artifact uploads and issue comments.
A repo-scoped token reads that repo fine: HTTP 200 on both the archive endpoint and the blocks directory. Scope is the only thing missing.
CI_TOKEN is set on neither repo — both secret lists are empty — which is why udg-copy-coverage.yml and test-generator.yml, which ask for that name, have failed on every run since at least 2026-09-11.

So CI_TOKEN is the single lever: setting it once turns this job, copy-coverage and test-generator green together, and leaves FORGEJO_TOKEN untouched so nothing that works today is disturbed.

Scope

One workflow file. The secret's name in the checkout step, and the comment and error message that explain it.

Testing

The job stays red until an org- or repo-scoped CI_TOKEN with repository read exists — that is the point of the change, and its failure now names the secret rather than dying on "Input required". Everything else about the gate is unchanged from #137, where it was verified against main: 31 generated files clean, 47 inherited blocks reported, and a reintroduced #136 bug caught with the file, block and attribute named.

Impact Statement

CI only. No change to any generated artifact, the theme, or the site. The job cannot pass before the secret is set; once it is, three workflows recover rather than one.

Follow-up to #137. The gate landed asking for `FORGEJO_TOKEN`; this points it at `CI_TOKEN`, so one secret serves all three jobs that check out the private sibling. What the runs on #137 established: - `FORGEJO_TOKEN` **is** supplied to the job — the error moved past "Input required and not supplied" — but checkout then reports "The target couldn't be found" for `Toilville/toilville_rituals`. It cannot read repositories; its twelve uses in the Rituals workflows are releases, artifact uploads and issue comments. - A repo-scoped token reads that repo fine: HTTP 200 on both the archive endpoint and the `blocks` directory. Scope is the only thing missing. - `CI_TOKEN` is set on neither repo — both secret lists are empty — which is why `udg-copy-coverage.yml` and `test-generator.yml`, which ask for that name, have failed on every run since at least 2026-09-11. So `CI_TOKEN` is the single lever: setting it once turns this job, copy-coverage and test-generator green together, and leaves `FORGEJO_TOKEN` untouched so nothing that works today is disturbed. ## Scope One workflow file. The secret's name in the checkout step, and the comment and error message that explain it. ## Testing The job stays red until an org- or repo-scoped `CI_TOKEN` with repository read exists — that is the point of the change, and its failure now names the secret rather than dying on "Input required". Everything else about the gate is unchanged from #137, where it was verified against `main`: 31 generated files clean, 47 inherited blocks reported, and a reintroduced #136 bug caught with the file, block and attribute named. ## Impact Statement CI only. No change to any generated artifact, the theme, or the site. The job cannot pass before the secret is set; once it is, three workflows recover rather than one.

peterswimm added 1 commit

2026-09-14 19:07:46 +00:00

ci: ask for CI_TOKEN, the name the other two sibling checkouts use

PR policy check / policy-gate (pull_request) Successful in 1s

Details

Block Validation / validate (pull_request) Failing after 22s

Details

Security Scans / Trivy filesystem scan (pull_request) Successful in 39s

Details

Security Scans / Gitleaks secret scan (pull_request) Successful in 29s

Details

Test Generator / test (pull_request) Failing after 17s

Details

Test Generator / lint-workflows (pull_request) Successful in 17s

Details

Test Generator / lint-prose (pull_request) Successful in 20s

Details

Copy coverage / Design copy reaching rendered HTML (pull_request) Failing after 23s

Details

UDG dist drift gate / dist/ matches dtcg + udg sources (pull_request) Successful in 14s

Details

7b1a13c8f2

FORGEJO_TOKEN is supplied org-wide but cannot read toilville_rituals —
checkout reports "The target couldn't be found", and that token is scoped
for releases, artifacts and issue comments rather than repository reads. A
repo-scoped token reads the repo fine.

CI_TOKEN is what udg-copy-coverage.yml and test-generator.yml already ask
for, so setting it once turns all three jobs green rather than only this
one.

peterswimm merged commit c51b65e111 into main

2026-09-14 19:08:00 +00:00

peterswimm deleted branch ci/gutenberg-block-validation

2026-09-14 19:08:01 +00:00

peterswimm referenced this pull request from a commit

2026-09-14 19:08:02 +00:00

Merge pull request 'ci: ask for CI_TOKEN, the name the other two sibling checkouts use' (#138) from ci/gutenberg-block-validation into main

peterswimm referenced this pull request

2026-09-14 21:31:12 +00:00

ci: read the blocks credential from OpenBao instead of a stored secret #139