oleks/ci-scripts
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases Wiki Activity

Org-level Woodpecker secrets + standardized token naming #11

New Issue
Closed
opened 2026-07-05 16:35:35 +03:00 by oleks · 1 comment
oleks commented 2026-07-05 16:35:35 +03:00
Owner
Copy Link
Copy Source

Move gitea_clone_token, registry_token, attic_token from per-repo secrets to org-level secrets for oleks/*; standardize on REGISTRY_TOKEN as the canonical env name. Includes fixing the latent bug in fastuuid-s390x and onnxruntime-s390x (declare CI_REGISTRY_TOKEN but never remap to REGISTRY_TOKEN before publish). If existing secret values can't be recovered (Woodpecker secrets are write-only), mint fresh Gitea tokens with equivalent scopes.

See Spec/Modern-CI-Target for requirements.

Move gitea_clone_token, registry_token, attic_token from per-repo secrets to org-level secrets for oleks/*; standardize on REGISTRY_TOKEN as the canonical env name. Includes fixing the latent bug in fastuuid-s390x and onnxruntime-s390x (declare CI_REGISTRY_TOKEN but never remap to REGISTRY_TOKEN before publish). If existing secret values can't be recovered (Woodpecker secrets are write-only), mint fresh Gitea tokens with equivalent scopes. See [Spec/Modern-CI-Target](wiki/Spec/Modern-CI-Target) for requirements.
oleks added this to the Modern CI Phase 2+3 milestone 2026-07-05 16:35:35 +03:00
oleks commented 2026-07-08 21:13:48 +03:00
Author
Owner
Copy Link
Copy Source

Verified & closing. Org-level Woodpecker secrets + REGISTRY_TOKEN standardization done and proven.

Delivered:

  • Org-level secrets created for the oleks org: gitea_clone_token, registry_token, attic_token (freshly minted; attic token from sops).
  • Standardized on REGISTRY_TOKEN as the canonical env name.
  • Fixed the latent CI_REGISTRY_TOKEN→REGISTRY_TOKEN remap bug: fastuuid-s390x 8e94a82, onnxruntime-s390x 0fe9cf9 (code-correct; note these s390x repos are now no-build per the 2026-07-08 hardware-unavailable directive, so they won't run — the fix stands as correct code / reference).

Verification (non-s390x, per the no-s390x-build directive): the ci-fleet-publish plugin build (v1.0.3, in the oleks org) resolves REGISTRY_TOKEN: from_secret: registry_token in .woodpecker/build-amd64.yaml, build-arm64.yaml, and manifest.yaml. oleks/ci-scripts has no repo-level secrets, so that registry_token resolved to the org-level secret. That build went fully green and pushed the multi-arch image to git.oleks.space/oleks/ci-fleet-publish:v1.0.3/:v1/:latest — proving the org registry_token works end-to-end.

(The originally-planned fastuuid-s390x green-run verification was cancelled and its tag deleted per the s390x no-build directive; the plugin-build evidence above supersedes it.)

**Verified & closing.** Org-level Woodpecker secrets + REGISTRY_TOKEN standardization done and proven. **Delivered:** - Org-level secrets created for the oleks org: `gitea_clone_token`, `registry_token`, `attic_token` (freshly minted; attic token from sops). - Standardized on `REGISTRY_TOKEN` as the canonical env name. - Fixed the latent CI_REGISTRY_TOKEN→REGISTRY_TOKEN remap bug: fastuuid-s390x `8e94a82`, onnxruntime-s390x `0fe9cf9` (code-correct; note these s390x repos are now **no-build** per the 2026-07-08 hardware-unavailable directive, so they won't run — the fix stands as correct code / reference). **Verification (non-s390x, per the no-s390x-build directive):** the `ci-fleet-publish` plugin build (v1.0.3, in the oleks org) resolves `REGISTRY_TOKEN: from_secret: registry_token` in `.woodpecker/build-amd64.yaml`, `build-arm64.yaml`, and `manifest.yaml`. `oleks/ci-scripts` has **no repo-level secrets**, so that `registry_token` resolved to the **org-level** secret. That build went fully green and **pushed the multi-arch image** to `git.oleks.space/oleks/ci-fleet-publish:v1.0.3/:v1/:latest` — proving the org `registry_token` works end-to-end. (The originally-planned fastuuid-s390x green-run verification was cancelled and its tag deleted per the s390x no-build directive; the plugin-build evidence above supersedes it.)
oleks closed this issue 2026-07-08 21:14:03 +03:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Bug or defect (requires fix)
 epic:modern-ci
p1
No labels
Milestone
No items
No Milestone Modern CI Phase 2+3
Projects
Clear projects
No projects
Assignees
Clear assignees
repo-worker oleks
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: oleks/ci-scripts#11
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?