varasys/zddc
Watch
4
0
Fork
You've already forked zddc
 2
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

deploy: take the package-write credential from git's credential helper, not ~/.git-token #6

Merged
casey merged 1 commit from bizon-agent/zddc:ci/deploy-credential-helper into main 2026-10-15 20:44:25 +00:00
Conversation 0 Commits 1 Files changed 4 +57 -14
bizon-agent commented 2026-10-15 20:22:21 +00:00
Member
Copy link

./deploy now takes its package-write credential from git's credential helper (git credential fill for the ZDDC_FORGEJO host, the same credential git push uses) instead of ~/.git-token.

  • ZDDC_FORGEJO_TOKEN, if set, still wins. CI is unchanged: release-record.sh sets it from PACKAGE_TOKEN.
  • With neither, ./deploy stops before touching the registry: "no package-write credential … (check with: git credential fill)".
  • No terminal prompt and no askpass. The value is never echoed.
  • shared/registry-lib.sh no longer reads any token file. Without ZDDC_FORGEJO_TOKEN, reads are anonymous.
  • Docs: AGENTS.md § Commands, § Release on merge.

Tests: sh .forgejo/scripts/test-release-on-merge.sh passes 21/21 (3 new cases, using a fake helper that answers with the host it was asked about; no real credential is read). A planted bug (taking the username field) turned the first case red. shellcheck -S warning is clean.

Not verifiable before a real ./deploy: that the bizon-agent entry in the store has package write.

🤖 Generated with Claude Code

`./deploy` now takes its package-write credential from git's credential helper (`git credential fill` for the `ZDDC_FORGEJO` host, the same credential `git push` uses) instead of `~/.git-token`. - `ZDDC_FORGEJO_TOKEN`, if set, still wins. CI is unchanged: `release-record.sh` sets it from `PACKAGE_TOKEN`. - With neither, `./deploy` stops before touching the registry: "no package-write credential … (check with: git credential fill)". - No terminal prompt and no askpass. The value is never echoed. - `shared/registry-lib.sh` no longer reads any token file. Without `ZDDC_FORGEJO_TOKEN`, reads are anonymous. - Docs: AGENTS.md § Commands, § Release on merge. Tests: `sh .forgejo/scripts/test-release-on-merge.sh` passes 21/21 (3 new cases, using a fake helper that answers with the host it was asked about; no real credential is read). A planted bug (taking the username field) turned the first case red. shellcheck -S warning is clean. Not verifiable before a real `./deploy`: that the bizon-agent entry in the store has package write. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
./deploy now asks `git credential fill` for the ZDDC_FORGEJO host (the same
credential `git push` uses) unless ZDDC_FORGEJO_TOKEN is set, and stops
before touching the registry when neither has one. No terminal prompt or
askpass; the value is never echoed. registry-lib.sh no longer reads any
token file: zddc_token is ZDDC_FORGEJO_TOKEN or nothing (anonymous reads),
so CI (PACKAGE_TOKEN -> ZDDC_FORGEJO_TOKEN) is unchanged.

Known answers (test-release-on-merge.sh, 21 cases): a stand-in helper that
answers with the host it was asked about proves the password field and the
host; no helper gives nothing and no prompt; ./deploy with no credential
refuses with its message. A planted bug (taking username) turned case red.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
casey merged commit 83b5351d9e into main 2026-10-15 20:44:25 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
varasys/zddc!6
No description provided.