From 1d346324c5ab2ec6fab4cdafc9d998cbe6d1a0eb Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com>
Date: Fri, 10 Jul 2026 16:01:20 +0200
Subject: [PATCH] ci: fetch private tramiton dep via ephemeral Actions token,
 not a PAT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sharang/tramiton lists sharang as a Collaborative Owner (tramiton → Settings →
Actions), so this repo's Actions can read tramiton. Use ${{ github.token }} in
the git credential rewrite instead of a TRAMITON_FETCH_TOKEN PAT — no secret to
manage. If cargo's git fetch 403s (feature scoped to uses:-actions only), fall
back to a PAT.

Refs #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 37c37ef..1e57418 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -50,13 +50,14 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS + a read token so the
-      # runner can fetch it. Requires a repo secret TRAMITON_FETCH_TOKEN — a
-      # Gitea PAT for a user with read access to sharang/tramiton.
+      # this Gitea instance). Rewrite its SSH URL to HTTPS + the ephemeral Actions
+      # token so the runner can fetch it — no PAT needed. This works because
+      # sharang/tramiton lists sharang as a Collaborative Owner (tramiton →
+      # Settings → Actions), which lets this repo's Actions read tramiton.
       - name: Configure git auth for private tramiton dependency
         run: |
           git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
+            url."https://gitea-actions:${{ github.token }}@gitea.meghsakha.com/".insteadOf \
             "ssh://git@gitea.meghsakha.com:22222/"
         env:
           RUSTC_WRAPPER: ""