VA-49: point cargo registry at psa-systems-private owner #51

Merged

nrupard merged 1 commit from fix/VA-49-cargo-bearer-token into main

2026-06-08 16:20:38 +02:00

nrupard commented

2026-06-08 16:19:44 +02:00

Owner

What

Repoints the psa-systems-cargo registry alias from owner psa-systems to psa-systems-private in .cargo/config.toml (sparse index) and the published-URL print in publish-crates.yml.

Why

The psa-systems owner's Forgejo Cargo registry is a public leftover: config.json reports auth-required: false and the index is empty. The intended target is the private psa-systems-private owner, whose config.json returns auth-required: true (401 reqPackageAccess unauthenticated). Two independent signals confirm it:

The publish secret is named PSA_SYSTEMS_PRIVATE_PACKAGE_PAT.
desktop-mcp/.cargo/config.toml already resolves psa-systems-cargo to sparse+https://dev.a8n.run/api/packages/psa-systems-private/cargo/.

Publishing to psa-systems would land the crates where desktop-mcp cannot read them, so the chain stays broken even after the Bearer auth fix (PR #50). This was flagged by the desktop-mcp worker after applying the same owner correction there.

Scope

Alias name psa-systems-cargo and per-crate publish = ["psa-systems-cargo"] are unchanged (they match desktop-mcp). build-package.yml's Generic Packages upload derives its owner from repo context and is untouched.

Follow-up

After merge: fj actions dispatch publish-crates.yml main -I ref=v0.1.0, then verify the psa-systems-private sparse index returns 0.1.0 for both crates.

#VA-49

## What Repoints the `psa-systems-cargo` registry alias from owner `psa-systems` to `psa-systems-private` in `.cargo/config.toml` (sparse index) and the published-URL print in `publish-crates.yml`. ## Why The `psa-systems` owner's Forgejo Cargo registry is a public leftover: `config.json` reports `auth-required: false` and the index is empty. The intended target is the private `psa-systems-private` owner, whose `config.json` returns `auth-required: true` (`401 reqPackageAccess` unauthenticated). Two independent signals confirm it: - The publish secret is named `PSA_SYSTEMS_PRIVATE_PACKAGE_PAT`. - `desktop-mcp/.cargo/config.toml` already resolves `psa-systems-cargo` to `sparse+https://dev.a8n.run/api/packages/psa-systems-private/cargo/`. Publishing to `psa-systems` would land the crates where desktop-mcp cannot read them, so the chain stays broken even after the Bearer auth fix (PR #50). This was flagged by the desktop-mcp worker after applying the same owner correction there. ## Scope Alias name `psa-systems-cargo` and per-crate `publish = ["psa-systems-cargo"]` are unchanged (they match desktop-mcp). `build-package.yml`'s Generic Packages upload derives its owner from repo context and is untouched. ## Follow-up After merge: `fj actions dispatch publish-crates.yml main -I ref=v0.1.0`, then verify the `psa-systems-private` sparse index returns 0.1.0 for both crates. #VA-49

nrupard added 1 commit

2026-06-08 16:19:45 +02:00

fix(registry): point cargo registry at psa-systems-private owner

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Check / clippy + fmt + tests (pull_request) Successful in 1m23s

Details

8047542c20

The `psa-systems-cargo` registry alias resolved to owner `psa-systems`, whose Forgejo Cargo registry is a public leftover (`auth-required: false`, empty index). The intended target is the private `psa-systems-private` owner (`auth-required: true`), which is also what the `PSA_SYSTEMS_PRIVATE_PACKAGE_PAT` secret name and desktop-mcp's `.cargo/config.toml` reference. Publishing to `psa-systems` would land the crates where desktop-mcp cannot read them, leaving the chain broken even after auth is fixed.

Repoint the sparse index in `.cargo/config.toml` and the published-URL print in `publish-crates.yml` to `psa-systems-private`. The alias name and per-crate `publish = ["psa-systems-cargo"]` are unchanged, matching desktop-mcp.

#VA-49