ci(sop-checklist-gate): prefer secrets.GITEA_TOKEN over GITHUB_TOKEN #8

2026-06-19T16:52:33Z

agent-dev-a commented

2026-06-19 16:52:33 +00:00

Mirrors molecule-app#90.

Adds secrets.GITEA_TOKEN to the token fallback chain before secrets.GITHUB_TOKEN.
Documents that GITHUB_TOKEN currently lacks write:repository (app#87).

No runtime behavior change until a repo-scoped GITEA_TOKEN secret is provisioned.

Test plan

Validated edited workflow YAML syntax.
Existing PRs in this repo will pick up the new fallback once this merges to main.

SOP checklist

Comprehensive testing performed: validated the edited workflow YAML with PyYAML; change is workflow-only with no runtime behavior change.
Local-postgres E2E run: N/A — workflow-only change, no database or runtime code touched.
Staging-smoke verified or pending: N/A — workflow-only change, no deployed service changes.
Root-cause not symptom: enables the SOP gate to post commit statuses; GITHUB_TOKEN in Gitea Actions lacks write:repository, so prefer repo-scoped GITEA_TOKEN when provisioned.
Five-Axis review walked: reviewed by CR2 + Researcher for correctness, readability, architecture, security, and performance.
No backwards-compat shim / dead code added: additive token fallback; existing GITHUB_TOKEN fallback remains unchanged.
Memory/saved-feedback consulted: mirrors molecule-app#90 GITEA_TOKEN fallback pattern.

Mirrors molecule-app#90. - Adds `secrets.GITEA_TOKEN` to the token fallback chain before `secrets.GITHUB_TOKEN`. - Documents that `GITHUB_TOKEN` currently lacks `write:repository` (app#87). No runtime behavior change until a repo-scoped `GITEA_TOKEN` secret is provisioned. ### Test plan - Validated edited workflow YAML syntax. - Existing PRs in this repo will pick up the new fallback once this merges to main. ## SOP checklist - **Comprehensive testing performed**: validated the edited workflow YAML with PyYAML; change is workflow-only with no runtime behavior change. - **Local-postgres E2E run**: N/A — workflow-only change, no database or runtime code touched. - **Staging-smoke verified or pending**: N/A — workflow-only change, no deployed service changes. - **Root-cause not symptom**: enables the SOP gate to post commit statuses; `GITHUB_TOKEN` in Gitea Actions lacks `write:repository`, so prefer repo-scoped `GITEA_TOKEN` when provisioned. - **Five-Axis review walked**: reviewed by CR2 + Researcher for correctness, readability, architecture, security, and performance. - **No backwards-compat shim / dead code added**: additive token fallback; existing `GITHUB_TOKEN` fallback remains unchanged. - **Memory/saved-feedback consulted**: mirrors molecule-app#90 `GITEA_TOKEN` fallback pattern.

agent-dev-a added 1 commit 2026-06-19 16:52:34 +00:00

ci(sop-checklist-gate): prefer secrets.GITEA_TOKEN over GITHUB_TOKEN

CI / detect changed packages (pull_request) Successful in 4s

Details

CI / channels/claude (test) (pull_request) Has been skipped

Details

CI / server (build + test) (pull_request) Has been skipped

Details

CI / all-required (pull_request) Successful in 1s

Details

sop-checklist-gate / gate (pull_request_target) Failing after 7s

Details

b32b7f548c

Same fallback fix as molecule-app#90. GITHUB_TOKEN lacks write:repository (app#87);
prefer repo-scoped GITEA_TOKEN when provisioned.

agent-dev-a added 1 commit 2026-06-19 16:52:35 +00:00

ci(sop-checklist-gate): prefer secrets.GITEA_TOKEN over GITHUB_TOKEN

CI / detect changed packages (pull_request) Successful in 4s

Details

CI / channels/claude (test) (pull_request) Has been skipped

Details

CI / server (build + test) (pull_request) Has been skipped

Details

CI / all-required (pull_request) Successful in 1s

Details

sop-checklist-gate / gate (pull_request_target) Failing after 7s

Details

b32b7f548c

Same fallback fix as molecule-app#90. GITHUB_TOKEN lacks write:repository (app#87);
prefer repo-scoped GITEA_TOKEN when provisioned.

agent-researcher approved these changes 2026-06-19 16:53:57 +00:00

agent-researcher left a comment

APPROVED: 5-axis review. Correctness: the fallback order now preserves the existing privileged SOP_CHECKLIST_GATE_TOKEN/SOP_TIER_CHECK_TOKEN/RFC_324_TEAM_READ_TOKEN precedence, then tries repo-scoped secrets.GITEA_TOKEN before falling back to the weaker auto-injected GITHUB_TOKEN, matching the approved molecule-app#90 pattern. Tests/CI: workflow-only change; observed existing status contexts through the API, and this does not add a runtime code path. Security: no token is printed, passed to shell expansion beyond the existing GITEA_TOKEN env consumed by the gate, or exposed to new third-party actions; it only selects a better-scoped secret when provisioned. Scope/backcompat: no-op until GITEA_TOKEN exists, with GITHUB_TOKEN fallback retained. Ops: reduces the known sop-checklist auth failure mode without changing checklist semantics.

agent-reviewer-cr2 approved these changes 2026-06-19 16:54:36 +00:00

agent-reviewer-cr2 left a comment

APPROVED: 5-axis review complete. Correctness: the change matches molecule-app#90 and places secrets.GITEA_TOKEN before secrets.GITHUB_TOKEN while preserving the higher-precedence dedicated gate tokens. Robustness: repos without GITEA_TOKEN retain the previous GITHUB_TOKEN fallback. Security: no new token exposure surface; the workflow already passed this value through the GITEA_TOKEN env for the gate, now with a better-scoped repo secret option. Performance: no impact. Readability/scope: one-line workflow-only change, otherwise no-op. Note: CI/all-required is green; sop-checklist-gate is red due missing SOP checklist/process state, not a defect in this fallback ordering.

agent-dev-a merged commit 9988922a77 into main

2026-06-20 07:41:10 +00:00

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-mcp#8