ci: publish with the org FORGEJO_PAT, not the Actions token #4

Merged

David merged 1 commit from fix/MCPWEB-2-publish-uses-forgejo-pat into main

2026-07-18 03:56:31 +02:00

David commented

2026-07-18 03:39:13 +02:00

Owner

What

Authenticate the cargo publish step with the pandoras-box org FORGEJO_PAT secret (which has package-write) instead of the automatic Actions token.

Why

Run #11 (dispatch of v0.1.0 after PR #3) showed the automatic Actions token authenticates but is not authorized to write packages into the org namespace:

HTTP/2 401
www-authenticate: Basic realm="Gitea Package API"
body: reqPackageAccess

That is an authorization ceiling, not a token-spelling issue (run #7's empty-token failure was a different body, authGroup.Verify). Org-namespace Cargo publishing needs a token whose owner has org package-write; the org already exposes FORGEJO_PAT for exactly this, and create-release.yml uses the same secret.

Change

publish-crates.yml: CARGO_REGISTRIES_PANDORAS_BOX_CARGO_TOKEN: Bearer ${{ secrets.FORGEJO_PAT }} (was secrets.GITHUB_TOKEN); comments updated. Bearer prefix retained.

After merge

v0.1.0 is tagged; I re-dispatch from main:

fj --host dev.a8n.run actions dispatch publish-crates.yml main -I ref=v0.1.0

Publishing mcp-web 0.1.0 unblocks the youtrack-mcp adoption (MCPWEB-1).

#MCPWEB-2

## What Authenticate the `cargo publish` step with the `pandoras-box` org `FORGEJO_PAT` secret (which has package-write) instead of the automatic Actions token. ## Why Run #11 (dispatch of `v0.1.0` after PR #3) showed the automatic Actions token authenticates but is not authorized to write packages into the org namespace: ``` HTTP/2 401 www-authenticate: Basic realm="Gitea Package API" body: reqPackageAccess ``` That is an authorization ceiling, not a token-spelling issue (run #7's empty-token failure was a different body, `authGroup.Verify`). Org-namespace Cargo publishing needs a token whose owner has org package-write; the org already exposes `FORGEJO_PAT` for exactly this, and `create-release.yml` uses the same secret. ## Change - `publish-crates.yml`: `CARGO_REGISTRIES_PANDORAS_BOX_CARGO_TOKEN: Bearer ${{ secrets.FORGEJO_PAT }}` (was `secrets.GITHUB_TOKEN`); comments updated. `Bearer ` prefix retained. ## After merge `v0.1.0` is tagged; I re-dispatch from main: ``` fj --host dev.a8n.run actions dispatch publish-crates.yml main -I ref=v0.1.0 ``` Publishing `mcp-web 0.1.0` unblocks the youtrack-mcp adoption (MCPWEB-1). #MCPWEB-2

David added 1 commit

2026-07-18 03:39:13 +02:00

ci: publish with the org FORGEJO_PAT, not the Actions token

Check / fmt + clippy + build + tests (pull_request) Successful in 10s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

05b10099f0

Run #11 proved the automatic Actions token authenticates but lacks package-write on the pandoras-box org (401 `reqPackageAccess`), so it cannot publish to the org-namespace Cargo registry. The org's `FORGEJO_PAT` secret carries package-write (and create-release.yml already uses it), so point the cargo publish token at it. Consumers still read anonymously (public org); only the write needs the PAT.

#MCPWEB-2