trove/curios
Public Access
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): isolate catalog write credentials

Browse Source
This commit is contained in:
render
2026-09-23 16:18:49 +08:00
parent 4ab217897e
commit 1fd77f0012
2 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/actions/curio-source/main.mjs
+12 -9
View File
@@ -615,12 +615,15 @@ async function proposeRelease() {
const trustedOwner = input("trusted_owner", "trove-curios");
if (!tag) throw new Error("Release tag is required");
if (repository.split("/")[0] !== trustedOwner) throw new Error(`${repository} is not an official Curio repository`);
const client = new Gitea();
const published = await verifyPublishedRelease(client, repository, tag, catalogRepository);
if (!process.env.CATALOG_TOKEN) throw new Error("Catalog write token is missing");
const sourceClient = new Gitea({ token: process.env.GITHUB_TOKEN });
const catalogClient = new Gitea({ token: process.env.CATALOG_TOKEN });
if (sourceClient.server !== catalogClient.server) throw new Error("Release and catalog must use the same Gitea server");
const published = await verifyPublishedRelease(sourceClient, repository, tag, catalogRepository);
const route = `/repos/${repositoryPath(catalogRepository)}`;
const file = await client.api(`${route}/contents/source/index.json?ref=main`);
const file = await catalogClient.api(`${route}/contents/source/index.json?ref=main`);
const base = decodeContent(file);
const repositoryUrl = `${client.server}/${repository}`;
const repositoryUrl = `${catalogClient.server}/${repository}`;
const next = applyDescriptor(base, published.descriptor, {
repositoryUrl,
descriptorUrl: published.descriptorAsset.browser_download_url,
@@ -635,16 +638,16 @@ async function proposeRelease() {
}
const plugin = published.descriptor.plugins[0];
const branch = `release/${plugin.id}/${plugin.version}`;
const open = await client.api(`${route}/pulls?state=open&limit=100`);
const open = await catalogClient.api(`${route}/pulls?state=open&limit=100`);
let pull = open.find((item) => item.head?.ref === branch);
const existingBranch = await client.api(
const existingBranch = await catalogClient.api(
`${route}/branches/${encodeURIComponent(branch)}`,
{ missing: true }
);
const branchFile = existingBranch ? await client.api(`${route}/contents/source/index.json?ref=${encodeURIComponent(branch)}`) : null;
const branchFile = existingBranch ? await catalogClient.api(`${route}/contents/source/index.json?ref=${encodeURIComponent(branch)}`) : null;
const branchContent = branchFile ? Buffer.from(branchFile.content, "base64").toString("utf8") : null;
if (branchContent !== content) {
await client.api(`${route}/contents/source/index.json`, {
await catalogClient.api(`${route}/contents/source/index.json`, {
method: "PUT",
body: {
branch: existingBranch ? branch : "main",
@@ -656,7 +659,7 @@ async function proposeRelease() {
});
}
if (!pull) {
pull = await client.api(`${route}/pulls`, {
pull = await catalogClient.api(`${route}/pulls`, {
method: "POST",
body: {
base: "main",