From 777d53354f6951b78c1ddf9ae470d9cdc346ffbf Mon Sep 17 00:00:00 2001 From: pi Date: Mon, 15 Jun 2026 22:30:36 +0200 Subject: [PATCH] docs(AGENTS): document GITEA_ACCESS_TOKEN env for general Gitea API access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GITEA_ACCESS_TOKEN + GITEA_HOST (passed from host .env via compose, primarily for gitea-mcp) are also usable for any direct Gitea API work — run inspection, tag checks — not just ci-release-watcher. Prefer over a PAT file when present; host-managed lifecycle, nothing to revoke. Release checklist step 7 now notes the env-token alternative. --- AGENTS.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index c465b82..fe12069 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -61,7 +61,24 @@ re-brand of opencode-devbox's `pi-only` variant. 6. Verify the Hub tags appear (latest + vX.Y.Z, the `-studio` pair, plus base-latest if the base was rebuilt this run). 7. **Revoke any short-lived Gitea PAT** used during the release at - `gitea.jordbo.se/user/settings/applications`. + `gitea.jordbo.se/user/settings/applications`. N/A if you used the + `GITEA_ACCESS_TOKEN` env var instead (see *Gitea API access* below) — + its lifecycle is managed host-side, nothing to revoke. + +## Gitea API access (env token) + +`GITEA_ACCESS_TOKEN` + `GITEA_HOST` are passed into the container from the +host `.env` via `docker-compose.yml` (`${GITEA_ACCESS_TOKEN:-}` / +`${GITEA_HOST:-}`), primarily to enable the `gitea-mcp` server. They are +**not** baked into the image. When configured, they are also available for +**any** direct Gitea API interaction from inside the container — inspecting +CI runs, checking published tags, listing commits — e.g. +`curl -H "Authorization: token $GITEA_ACCESS_TOKEN" "$GITEA_HOST/api/v1/repos/joakimp/pi-devbox/actions/runs?limit=5"`. +Prefer this over a short-lived PAT file when the env token is present (the +`ci-release-watcher` skill auto-detects it). Public-repo GET listings work +unauthenticated too, so the token matters mainly for private repos or +rate-limit headroom; its lifecycle is host-managed, so there is nothing to +revoke after use. Never echo the token value (including into logs). ## Cache-hit footgun (must-know)