ci: publish with the automatic Actions token, not a PAT #3

Merged

David merged 1 commit from fix/MCPWEB-2-publish-uses-actions-token into main

2026-07-18 03:25:53 +02:00

David commented

2026-07-18 03:25:11 +02:00

Owner

What

Publish mcp-web using Forgejo's automatic Actions token instead of a manually-created PAT. The Pandora's Box org is public, so consumers resolve/download the crate anonymously; the publish step (a write) still authenticates, but via secrets.GITHUB_TOKEN, which the job already authorizes with permissions: packages: write.

Why

Run #7 (tag v0.1.0) failed at cargo publish with 401 authGroup.Verify because PANDORAS_BOX_PRIVATE_PACKAGE_PAT was never configured. Rather than add a PAT secret, use the built-in token: zero manually-managed secrets, and it is scoped to exactly this repo's package writes.

Change

publish-crates.yml: CARGO_REGISTRIES_PANDORAS_BOX_CARGO_TOKEN: Bearer ${{ secrets.GITHUB_TOKEN }} (was secrets.PANDORAS_BOX_PRIVATE_PACKAGE_PAT); header/comment updated. The Bearer prefix stays (the Forgejo Cargo registry 401s without it).

After merge

v0.1.0 is already tagged, so publish with:

fj --host dev.a8n.run actions dispatch publish-crates.yml main -I ref=v0.1.0

Dispatching from main uses this fixed workflow and publishes the v0.1.0 source, unblocking the youtrack-mcp adoption (MCPWEB-1).

Note

create-release.yml still references secrets.FORGEJO_PAT (for the release API + workflow dispatch on the automated release/v* path). That is a separate secret and not exercised by this manual 0.1.0 publish; if you want that path PAT-free too, say so and I will switch it to the built-in token (it needs contents: write + actions: write job permissions).

#MCPWEB-2

## What Publish `mcp-web` using Forgejo's automatic Actions token instead of a manually-created PAT. The Pandora's Box org is public, so consumers resolve/download the crate anonymously; the publish step (a write) still authenticates, but via `secrets.GITHUB_TOKEN`, which the job already authorizes with `permissions: packages: write`. ## Why Run #7 (tag `v0.1.0`) failed at `cargo publish` with `401 authGroup.Verify` because `PANDORAS_BOX_PRIVATE_PACKAGE_PAT` was never configured. Rather than add a PAT secret, use the built-in token: zero manually-managed secrets, and it is scoped to exactly this repo's package writes. ## Change - `publish-crates.yml`: `CARGO_REGISTRIES_PANDORAS_BOX_CARGO_TOKEN: Bearer ${{ secrets.GITHUB_TOKEN }}` (was `secrets.PANDORAS_BOX_PRIVATE_PACKAGE_PAT`); header/comment updated. The `Bearer ` prefix stays (the Forgejo Cargo registry 401s without it). ## After merge `v0.1.0` is already tagged, so publish with: ``` fj --host dev.a8n.run actions dispatch publish-crates.yml main -I ref=v0.1.0 ``` Dispatching from `main` uses this fixed workflow and publishes the `v0.1.0` source, unblocking the youtrack-mcp adoption (MCPWEB-1). ## Note `create-release.yml` still references `secrets.FORGEJO_PAT` (for the release API + workflow dispatch on the automated `release/v*` path). That is a separate secret and not exercised by this manual `0.1.0` publish; if you want that path PAT-free too, say so and I will switch it to the built-in token (it needs `contents: write` + `actions: write` job permissions). #MCPWEB-2

David added 1 commit

2026-07-18 03:25:11 +02:00

ci: publish with the automatic Actions token, not a PAT

Check / fmt + clippy + build + tests (pull_request) Successful in 28s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

f8dccb2e8d

The Pandora's Box org is public, so consumers read the crate anonymously and no manually-created publish PAT is needed. The publish (write) still authenticates, via Forgejo's automatic Actions token (`secrets.GITHUB_TOKEN`), authorized by the job's existing `permissions: packages: write`. Drops the `PANDORAS_BOX_PRIVATE_PACKAGE_PAT` secret, which was unset and caused run #7 to 401 (`authGroup.Verify`).

#MCPWEB-2