VA-49: prepend Bearer to cargo registry token to fix 401 on publish #50

Merged

nrupard merged 1 commit from fix/VA-49-cargo-bearer-token into main

2026-06-08 15:53:46 +02:00

nrupard commented

2026-06-08 15:52:59 +02:00

Owner

What

Prepends the literal Bearer prefix to the cargo registry token env in publish-crates.yml.

Why

cargo sends the CARGO_REGISTRIES_*_TOKEN value verbatim as the Authorization header. The Forgejo Cargo registry rejects a bare PAT with HTTP 401 (authGroup.Verify) and requires Authorization: Bearer <pat>. Per the Forgejo docs: "prepend the string 'Bearer ' to your API token" (https://forgejo.org/docs/latest/user/packages/cargo/).

Publish runs #163 and #164 reached the upload step cleanly. resolve, package, and the verify build of vervain-agent-mcp v0.1.0 all passed; the run failed only at Uploading with 401. This prefix is the fix.

Scope

The Actions secret PSA_SYSTEMS_PRIVATE_PACKAGE_PAT stays the raw PAT, so build-package.yml's Generic Packages upload (different auth scheme) is unaffected. The Bearer prefix lives only in the cargo step's env.

Verification plan after merge

Dispatch fj actions dispatch publish-crates.yml main -I ref=v0.1.0, then confirm the sparse index returns 0.1.0 for both crates and the registry lists them.

#VA-49

## What Prepends the literal `Bearer ` prefix to the cargo registry token env in `publish-crates.yml`. ## Why cargo sends the `CARGO_REGISTRIES_*_TOKEN` value verbatim as the `Authorization` header. The Forgejo Cargo registry rejects a bare PAT with HTTP 401 (`authGroup.Verify`) and requires `Authorization: Bearer <pat>`. Per the Forgejo docs: "prepend the string 'Bearer ' to your API token" (https://forgejo.org/docs/latest/user/packages/cargo/). Publish runs #163 and #164 reached the upload step cleanly. resolve, package, and the verify build of `vervain-agent-mcp v0.1.0` all passed; the run failed only at `Uploading` with 401. This prefix is the fix. ## Scope The Actions secret `PSA_SYSTEMS_PRIVATE_PACKAGE_PAT` stays the raw PAT, so `build-package.yml`'s Generic Packages upload (different auth scheme) is unaffected. The `Bearer ` prefix lives only in the cargo step's env. ## Verification plan after merge Dispatch `fj actions dispatch publish-crates.yml main -I ref=v0.1.0`, then confirm the sparse index returns 0.1.0 for both crates and the registry lists them. #VA-49

nrupard added 1 commit

2026-06-08 15:52:59 +02:00

fix(ci): prepend Bearer to cargo registry token

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Check / clippy + fmt + tests (pull_request) Successful in 1m38s

Details

c4b43b4f95

cargo sends the `CARGO_REGISTRIES_*_TOKEN` value verbatim as the `Authorization` header. The Forgejo Cargo registry rejects a bare PAT with HTTP 401 (`authGroup.Verify`) and expects `Authorization: Bearer <pat>`, so the token env must carry the literal `Bearer ` prefix (https://forgejo.org/docs/latest/user/packages/cargo/: "prepend the string 'Bearer ' to your API token").

Runs #163/#164 reached the upload step cleanly (resolve, package, and verify build all passed) and failed only at upload with 401, which this fixes. The secret stays the raw PAT so build-package.yml's Generic Packages upload, which uses a different auth scheme, keeps working.

#VA-49