trove/curios
Public Access
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): isolate catalog write credentials

Browse Source
This commit is contained in:
render
2026-09-23 16:18:49 +08:00
parent 4ab217897e
commit 1fd77f0012
2 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/actions/curio-source/main.mjs
+12 -9
View File
@@ -615,12 +615,15 @@ async function proposeRelease() {
const trustedOwner = input("trusted_owner", "trove-curios"); const trustedOwner = input("trusted_owner", "trove-curios");
if (!tag) throw new Error("Release tag is required"); if (!tag) throw new Error("Release tag is required");
if (repository.split("/")[0] !== trustedOwner) throw new Error(`${repository} is not an official Curio repository`); if (repository.split("/")[0] !== trustedOwner) throw new Error(`${repository} is not an official Curio repository`);
const client = new Gitea(); if (!process.env.CATALOG_TOKEN) throw new Error("Catalog write token is missing");
const published = await verifyPublishedRelease(client, repository, tag, catalogRepository); const sourceClient = new Gitea({ token: process.env.GITHUB_TOKEN });
const catalogClient = new Gitea({ token: process.env.CATALOG_TOKEN });
if (sourceClient.server !== catalogClient.server) throw new Error("Release and catalog must use the same Gitea server");
const published = await verifyPublishedRelease(sourceClient, repository, tag, catalogRepository);
const route = `/repos/${repositoryPath(catalogRepository)}`; const route = `/repos/${repositoryPath(catalogRepository)}`;
const file = await client.api(`${route}/contents/source/index.json?ref=main`); const file = await catalogClient.api(`${route}/contents/source/index.json?ref=main`);
const base = decodeContent(file); const base = decodeContent(file);
const repositoryUrl = `${client.server}/${repository}`; const repositoryUrl = `${catalogClient.server}/${repository}`;
const next = applyDescriptor(base, published.descriptor, { const next = applyDescriptor(base, published.descriptor, {
repositoryUrl, repositoryUrl,
descriptorUrl: published.descriptorAsset.browser_download_url, descriptorUrl: published.descriptorAsset.browser_download_url,
@@ -635,16 +638,16 @@ async function proposeRelease() {
} }
const plugin = published.descriptor.plugins[0]; const plugin = published.descriptor.plugins[0];
const branch = `release/${plugin.id}/${plugin.version}`; const branch = `release/${plugin.id}/${plugin.version}`;
const open = await client.api(`${route}/pulls?state=open&limit=100`); const open = await catalogClient.api(`${route}/pulls?state=open&limit=100`);
let pull = open.find((item) => item.head?.ref === branch); let pull = open.find((item) => item.head?.ref === branch);
const existingBranch = await client.api( const existingBranch = await catalogClient.api(
`${route}/branches/${encodeURIComponent(branch)}`, `${route}/branches/${encodeURIComponent(branch)}`,
{ missing: true } { missing: true }
); );
const branchFile = existingBranch ? await client.api(`${route}/contents/source/index.json?ref=${encodeURIComponent(branch)}`) : null; const branchFile = existingBranch ? await catalogClient.api(`${route}/contents/source/index.json?ref=${encodeURIComponent(branch)}`) : null;
const branchContent = branchFile ? Buffer.from(branchFile.content, "base64").toString("utf8") : null; const branchContent = branchFile ? Buffer.from(branchFile.content, "base64").toString("utf8") : null;
if (branchContent !== content) { if (branchContent !== content) {
await client.api(`${route}/contents/source/index.json`, { await catalogClient.api(`${route}/contents/source/index.json`, {
method: "PUT", method: "PUT",
body: { body: {
branch: existingBranch ? branch : "main", branch: existingBranch ? branch : "main",
@@ -656,7 +659,7 @@ async function proposeRelease() {
}); });
} }
if (!pull) { if (!pull) {
pull = await client.api(`${route}/pulls`, { pull = await catalogClient.api(`${route}/pulls`, {
method: "POST", method: "POST",
body: { body: {
base: "main", base: "main",
.gitea/workflows/validate-pr.yml
-2
View File
@@ -24,5 +24,3 @@ jobs:
mode: validate mode: validate
catalog: trove/curios catalog: trove/curios
trusted_owner: trove-curios trusted_owner: trove-curios
env:
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}