ci: revert to PAT for private tramiton dependency fetch

Use the TRAMITON_FETCH_TOKEN repo secret (Gitea PAT) to fetch tramiton-core over HTTPS. Deploy-key path dropped per preference; the PAT has been added to secrets. Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ci: fetch private tramiton dep via read-only SSH deploy key
2026-07-10 16:14:17 +02:00 · 2026-07-10 16:13:02 +02:00 · 2026-07-10 16:08:12 +02:00 · 2026-07-10 16:01:20 +02:00
1 changed files with 4 additions and 3 deletions
@@ -50,9 +50,10 @@ jobs:
          RUSTC_WRAPPER: ""
      # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS + a read token so the
+      # this Gitea instance). Rewrite its SSH URL to HTTPS + a PAT so the runner
-      # runner can fetch it. Requires a repo secret TRAMITON_FETCH_TOKEN — a
+      # can fetch it. Requires the repo secret TRAMITON_FETCH_TOKEN (a Gitea PAT
-      # Gitea PAT for a user with read access to sharang/tramiton.
+      # with read:repository, owned by a user with access to sharang/tramiton).
      # (Honored on fetch because CARGO_NET_GIT_FETCH_WITH_CLI=true uses system git.)
      - name: Configure git auth for private tramiton dependency
        run: |
          git config --global \
Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	cdcbf2c714	ci: revert to PAT for private tramiton dependency fetch CI / Check (pull_request) Successful in 9m2s Details CI / Detect Changes (pull_request) Has been skipped Details CI / Deploy Agent (pull_request) Has been skipped Details CI / Deploy Dashboard (pull_request) Has been skipped Details CI / Deploy Docs (pull_request) Has been skipped Details CI / Deploy MCP (pull_request) Has been skipped Details Use the TRAMITON_FETCH_TOKEN repo secret (Gitea PAT) to fetch tramiton-core over HTTPS. Deploy-key path dropped per preference; the PAT has been added to secrets. Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:14:17 +02:00
Sharang ParnerkarandClaude Fable 5	5f59635bf8	ci: fetch private tramiton dep via read-only SSH deploy key CI / Detect Changes (pull_request) Has been cancelled Details CI / Deploy Agent (pull_request) Has been cancelled Details CI / Deploy Dashboard (pull_request) Has been cancelled Details CI / Deploy Docs (pull_request) Has been cancelled Details CI / Deploy MCP (pull_request) Has been cancelled Details CI / Check (pull_request) Has been cancelled Details Gitea PATs can't be scoped to a single repo and the ephemeral Actions token can't clone a private git dependency (verified: "Repository not found" even with Collaborative Owners + the actions/checkout extraheader form). A read-only Deploy Key is per-repo least privilege: load it from the TRAMITON_DEPLOY_KEY secret and let cargo fetch tramiton over SSH (dep URL is already ssh://…:22222). Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:13:02 +02:00
Sharang ParnerkarandClaude Fable 5	03e39a883d	ci: authenticate tramiton fetch via extraheader (actions/checkout form) CI / Deploy MCP (pull_request) Has been skipped Details CI / Check (pull_request) Failing after 1m30s Details CI / Detect Changes (pull_request) Has been skipped Details CI / Deploy Agent (pull_request) Has been skipped Details CI / Deploy Dashboard (pull_request) Has been skipped Details CI / Deploy Docs (pull_request) Has been skipped Details The placeholder-username URL form returned "Repository not found". Switch to the canonical http.extraheader Basic-auth used by actions/checkout (x-access-token:<token>) to remove the username variable. Definitive test of whether the Collaborative Owner grant covers a cargo git-dep clone. Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:08:12 +02:00
Sharang ParnerkarandClaude Fable 5	1d346324c5	ci: fetch private tramiton dep via ephemeral Actions token, not a PAT CI / Check (pull_request) Failing after 1m27s Details CI / Detect Changes (pull_request) Has been skipped Details CI / Deploy Agent (pull_request) Has been skipped Details CI / Deploy Dashboard (pull_request) Has been skipped Details CI / Deploy Docs (pull_request) Has been skipped Details CI / Deploy MCP (pull_request) Has been skipped Details sharang/tramiton lists sharang as a Collaborative Owner (tramiton → Settings → Actions), so this repo's Actions can read tramiton. Use ${{ github.token }} in the git credential rewrite instead of a TRAMITON_FETCH_TOKEN PAT — no secret to manage. If cargo's git fetch 403s (feature scoped to uses:-actions only), fall back to a PAT. Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:01:20 +02:00