fix(ci): move FORGEJO_TOKEN to step-env so the secret reaches nu #113

Merged

David merged 1 commit from fix/forgejo-token-step-env-v2 into main

2026-05-15 03:25:27 +02:00

David commented

2026-05-15 03:22:00 +02:00

Owner

Summary

#112's build-desktop-linux.yml run failed at DELETE:

Deleting existing https://dev.a8n.run/api/packages/a8n-tools-private/generic/lets-chat/latest/lets-chat-desktop-linux-x86_64 if present
Unexpected DELETE status: 401

Same secret + same URL + same workflow shape as yotun/.forgejo/workflows/build-desktop-linux.yml::Upload to generic package registry, which is the working reference. The structural difference is scope: yotun declares FORGEJO_TOKEN in the step-level env: block on the upload step; #110/#112 had it in the job-level env: block. Inside the shell: nu {0} step $env.FORGEJO_TOKEN evidently resolved to an empty string from job scope, producing the literal header Authorization: token (token, space, empty) which Forgejo's Packages endpoint correctly rejects with 401.

PACKAGE_OWNER and PACKAGE_NAME from the same job-env block survive fine (the URL in the failing log has a8n-tools-private and lets-chat interpolated correctly), so this is specific to how Forgejo Actions surfaces secrets vs vars at job scope rather than to all job-env values.

Changes (three files, mirroring yotun)

.forgejo/workflows/build-desktop-linux.yml
.forgejo/workflows/build-desktop-windows.yml
.forgejo/workflows/publish-release.yml

Each file: remove FORGEJO_TOKEN: ${{ secrets.A8N_TOOLS_PRIVATE_PACKAGE_PAT }} from the job-level env: block, add the same line to the step-level env: block on the Upload binary[ies] ... to Generic Packages step. PACKAGE_OWNER and PACKAGE_NAME stay at job-env because they work there. Job-env comments call out the gotcha so the next reader does not move FORGEJO_TOKEN back up.

The nu-builtin call shape itself, the URL builder, and the [204 404] DELETE-status guard from #112 are unchanged. This commit is strictly the secret-scope move.

Test plan

Next push to main: build-desktop-linux.yml and build-desktop-windows.yml complete and produce ${ORG}/generic/lets-chat/latest/lets-chat-desktop-{linux,windows}-x86_64[.exe] in the Generic Packages UI. No 401.
DELETE step prints 204 on the run that overwrites a prior upload, 404 on the very first run when there is nothing to delete.

## Summary #112's `build-desktop-linux.yml` run failed at DELETE: ``` Deleting existing https://dev.a8n.run/api/packages/a8n-tools-private/generic/lets-chat/latest/lets-chat-desktop-linux-x86_64 if present Unexpected DELETE status: 401 ``` Same secret + same URL + same workflow shape as `yotun/.forgejo/workflows/build-desktop-linux.yml::Upload to generic package registry`, which is the working reference. The structural difference is **scope**: yotun declares `FORGEJO_TOKEN` in the *step*-level `env:` block on the upload step; #110/#112 had it in the *job*-level `env:` block. Inside the `shell: nu {0}` step `$env.FORGEJO_TOKEN` evidently resolved to an empty string from job scope, producing the literal header `Authorization: token ` (token, space, empty) which Forgejo's Packages endpoint correctly rejects with 401. `PACKAGE_OWNER` and `PACKAGE_NAME` from the same job-env block survive fine (the URL in the failing log has `a8n-tools-private` and `lets-chat` interpolated correctly), so this is specific to how Forgejo Actions surfaces secrets vs vars at job scope rather than to all job-env values. ## Changes (three files, mirroring yotun) - `.forgejo/workflows/build-desktop-linux.yml` - `.forgejo/workflows/build-desktop-windows.yml` - `.forgejo/workflows/publish-release.yml` Each file: remove `FORGEJO_TOKEN: ${{ secrets.A8N_TOOLS_PRIVATE_PACKAGE_PAT }}` from the **job**-level `env:` block, add the same line to the **step**-level `env:` block on the `Upload binary[ies] ... to Generic Packages` step. `PACKAGE_OWNER` and `PACKAGE_NAME` stay at job-env because they work there. Job-env comments call out the gotcha so the next reader does not move FORGEJO_TOKEN back up. The nu-builtin call shape itself, the URL builder, and the `[204 404]` DELETE-status guard from #112 are unchanged. This commit is strictly the secret-scope move. ## Test plan - [ ] Next push to `main`: `build-desktop-linux.yml` and `build-desktop-windows.yml` complete and produce `${ORG}/generic/lets-chat/latest/lets-chat-desktop-{linux,windows}-x86_64[.exe]` in the Generic Packages UI. No 401. - [ ] DELETE step prints `204` on the run that overwrites a prior upload, `404` on the very first run when there is nothing to delete.

David added 1 commit

2026-05-15 03:22:00 +02:00

fix(ci): move FORGEJO_TOKEN to step-env so the secret reaches nu

Check / clippy + fmt + tests (pull_request) Successful in 1m7s

Details

f1ccc2b364

`build-desktop-linux.yml` ran #112's nu-builtin code and DELETE returned 401:

    Deleting existing https://dev.a8n.run/api/packages/a8n-tools-private/generic/lets-chat/latest/lets-chat-desktop-linux-x86_64 if present
    Unexpected DELETE status: 401

Same secret + same URL + same workflow shape as `yotun/.forgejo/workflows/build-desktop-linux.yml::Upload to generic package registry`, which is the working reference. The one structural difference is scope: yotun declares `FORGEJO_TOKEN` in the step `env:` block on the upload step; #110/#112 had it in the job `env:` block. Inside the nu step `$env.FORGEJO_TOKEN` evidently resolved to an empty string from job scope, producing the literal header `Authorization: token ` (token, space, nothing) which Forgejo's Packages endpoint correctly rejects with 401. `PACKAGE_OWNER` and `PACKAGE_NAME` from the same job-env block survive fine (the URL in the failing log has `a8n-tools-private` and `lets-chat` interpolated correctly), so this looks specific to how Forgejo Actions surfaces secrets vs vars at job scope rather than to all job-env values.

Three files updated, mirroring yotun: remove `FORGEJO_TOKEN: ${{ secrets.A8N_TOOLS_PRIVATE_PACKAGE_PAT }}` from the job-level `env:` block, add it to the step-level `env:` block on the `Upload binary to Generic Packages` / `Upload binaries and manifest to Generic Packages` step in `.forgejo/workflows/build-desktop-linux.yml`, `.forgejo/workflows/build-desktop-windows.yml`, and `.forgejo/workflows/publish-release.yml`. `PACKAGE_OWNER` and `PACKAGE_NAME` stay at job-env because they work there. Job-env comments updated to call out the gotcha so the next reader does not move FORGEJO_TOKEN back up.

The nu-builtin call shape itself, the URL builder, and the 204/404 DELETE guard from #112 are unchanged. This commit is strictly the secret-scope move.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>