From 1fd77f001250b105f6e1566f4b43fa662b7c1db8 Mon Sep 17 00:00:00 2001
From: render <zjcrender@gmail.com>
Date: Wed, 23 Sep 2026 16:18:49 +0800
Subject: [PATCH] fix(ci): isolate catalog write credentials

---
 .gitea/actions/curio-source/main.mjs | 21 ++++++++++++---------
 .gitea/workflows/validate-pr.yml     |  2 --
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/.gitea/actions/curio-source/main.mjs b/.gitea/actions/curio-source/main.mjs
index 76e76ae..5c1ebbe 100644
--- a/.gitea/actions/curio-source/main.mjs
+++ b/.gitea/actions/curio-source/main.mjs
@@ -615,12 +615,15 @@ async function proposeRelease() {
   const trustedOwner = input("trusted_owner", "trove-curios");
   if (!tag) throw new Error("Release tag is required");
   if (repository.split("/")[0] !== trustedOwner) throw new Error(`${repository} is not an official Curio repository`);
-  const client = new Gitea();
-  const published = await verifyPublishedRelease(client, repository, tag, catalogRepository);
+  if (!process.env.CATALOG_TOKEN) throw new Error("Catalog write token is missing");
+  const sourceClient = new Gitea({ token: process.env.GITHUB_TOKEN });
+  const catalogClient = new Gitea({ token: process.env.CATALOG_TOKEN });
+  if (sourceClient.server !== catalogClient.server) throw new Error("Release and catalog must use the same Gitea server");
+  const published = await verifyPublishedRelease(sourceClient, repository, tag, catalogRepository);
   const route = `/repos/${repositoryPath(catalogRepository)}`;
-  const file = await client.api(`${route}/contents/source/index.json?ref=main`);
+  const file = await catalogClient.api(`${route}/contents/source/index.json?ref=main`);
   const base = decodeContent(file);
-  const repositoryUrl = `${client.server}/${repository}`;
+  const repositoryUrl = `${catalogClient.server}/${repository}`;
   const next = applyDescriptor(base, published.descriptor, {
     repositoryUrl,
     descriptorUrl: published.descriptorAsset.browser_download_url,
@@ -635,16 +638,16 @@ async function proposeRelease() {
   }
   const plugin = published.descriptor.plugins[0];
   const branch = `release/${plugin.id}/${plugin.version}`;
-  const open = await client.api(`${route}/pulls?state=open&limit=100`);
+  const open = await catalogClient.api(`${route}/pulls?state=open&limit=100`);
   let pull = open.find((item) => item.head?.ref === branch);
-  const existingBranch = await client.api(
+  const existingBranch = await catalogClient.api(
     `${route}/branches/${encodeURIComponent(branch)}`,
     { missing: true }
   );
-  const branchFile = existingBranch ? await client.api(`${route}/contents/source/index.json?ref=${encodeURIComponent(branch)}`) : null;
+  const branchFile = existingBranch ? await catalogClient.api(`${route}/contents/source/index.json?ref=${encodeURIComponent(branch)}`) : null;
   const branchContent = branchFile ? Buffer.from(branchFile.content, "base64").toString("utf8") : null;
   if (branchContent !== content) {
-    await client.api(`${route}/contents/source/index.json`, {
+    await catalogClient.api(`${route}/contents/source/index.json`, {
       method: "PUT",
       body: {
         branch: existingBranch ? branch : "main",
@@ -656,7 +659,7 @@ async function proposeRelease() {
     });
   }
   if (!pull) {
-    pull = await client.api(`${route}/pulls`, {
+    pull = await catalogClient.api(`${route}/pulls`, {
       method: "POST",
       body: {
         base: "main",
diff --git a/.gitea/workflows/validate-pr.yml b/.gitea/workflows/validate-pr.yml
index d681523..dcbf3d8 100644
--- a/.gitea/workflows/validate-pr.yml
+++ b/.gitea/workflows/validate-pr.yml
@@ -24,5 +24,3 @@ jobs:
           mode: validate
           catalog: trove/curios
           trusted_owner: trove-curios
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}