fix(renovate): no 'workflow' scope on Forgejo; self-diagnose token #6

Closed

forgejo-actions wants to merge 1 commit from fix/renovate-token-scopes-diag into master

forgejo-actions commented

2026-06-29 10:13:31 +00:00

Closes #1 (final piece) / continues #5

The two questions from #1 (comment)

1. "`workflow` is not available as option" — correct, it doesn't exist

Forgejo/Gitea has no workflow scope. That scope is GitHub-only. The earlier instruction in #5 ("create a PAT with scopes issue, repository, workflow") was copy-pasted from GitHub's PAT requirements, so it asked for something the Forgejo UI can't offer. That's why you can't find it — and you don't need it.

On Forgejo, Renovate needs exactly two scopes:

Scope	Why
`write:repository`	clone the repo + push update branches
`write:issue`	open / update / close pull requests

⚠️ Make sure the write: level is selected, not read:. A read-only PAT passes /user and looks valid, then fails the moment Renovate tries to push.

2. "Still rejected — how to troubleshoot?"

The previous run (#10) failed before this was diagnosed (the agent hit a 429). Three likely causes, in order:

Secret holds a stale/invalid value. You regenerated the token but didn't paste the new value into the RENOVATE_TOKEN repo secret (Settings → Actions → Secrets), or copied it with a stray space/newline.
Read-only scopes. Token was created with read:repository/read:issue instead of write:.
Ghost token. The secret (or an old || github.token fallback) resolves to the forgejo-actions bot, which can't own PRs.

Manual check with your PAT (run anywhere):

TOKEN=<paste your PAT>
# a) valid + which user?  (must be a REAL user, HTTP 200)
curl -s -o /dev/null -w '%{http_code}\n' -H "Authorization: token $TOKEN" \
  https://forge.l3x.in/api/v1/user
# b) write access?  create+delete a throwaway branch (HTTP 201 then 204)
curl -s -o /dev/null -w '%{http_code}\n' -X POST -H "Authorization: token $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"new_branch_name":"scope-probe","old_branch_name":"master"}' \
  https://forge.l3x.in/api/v1/repos/alex/pi-shared/branches
curl -s -o /dev/null -X DELETE -H "Authorization: token $TOKEN" \
  https://forge.l3x.in/api/v1/repos/alex/pi-shared/branches/scope-probe

(a) ≠ 200 → wrong/stale value in the secret.
(b) = 403/401 → PAT is read-only; re-create with write:repository+write:issue.
(b) = 201 → scopes are correct; update the repo secret and re-run.

What this PR changes

Replaces the validate step with a self-diagnosing version so the next failure names the exact cause instead of Renovate's opaque Authentication failure:

empty/unset secret → tells you the correct scopes (write:repository+write:issue, no workflow);
authenticates as the forgejo-actions ghost → "needs a PAT for a real account";
read-only PAT → creates+deletes a probe branch; 401/403 ⇒ fatal "read-only" error, anything else ⇒ non-fatal warning.

All messages drop the bogus workflow scope. Validated: YAML parses, bash -n passes, and running the step with the ghost token correctly stops at check (2) with the right message (and never mutates anything).

Closes #1 (final piece) / continues #5 ## The two questions from #1 (comment) ### 1. "`workflow` is not available as option" — correct, it doesn't exist **Forgejo/Gitea has no `workflow` scope.** That scope is **GitHub-only**. The earlier instruction in #5 ("create a PAT with scopes `issue, repository, workflow`") was copy-pasted from GitHub's PAT requirements, so it asked for something the Forgejo UI can't offer. That's why you can't find it — and **you don't need it**. On Forgejo, Renovate needs exactly **two** scopes: | Scope | Why | |-------|-----| | `write:repository` | clone the repo + push update branches | | `write:issue` | open / update / close pull requests | > ⚠️ Make sure the **`write:`** level is selected, not `read:`. A read-only PAT passes `/user` and looks valid, then fails the moment Renovate tries to push. ### 2. "Still rejected — how to troubleshoot?" The previous run (#10) failed before this was diagnosed (the agent hit a 429). Three likely causes, in order: - **Secret holds a stale/invalid value.** You regenerated the token but didn't paste the **new** value into the `RENOVATE_TOKEN` repo secret (Settings → Actions → Secrets), or copied it with a stray space/newline. - **Read-only scopes.** Token was created with `read:repository`/`read:issue` instead of `write:`. - **Ghost token.** The secret (or an old `|| github.token` fallback) resolves to the `forgejo-actions` bot, which can't own PRs. **Manual check with your PAT** (run anywhere): ```bash TOKEN=<paste your PAT> # a) valid + which user? (must be a REAL user, HTTP 200) curl -s -o /dev/null -w '%{http_code}\n' -H "Authorization: token $TOKEN" \ https://forge.l3x.in/api/v1/user # b) write access? create+delete a throwaway branch (HTTP 201 then 204) curl -s -o /dev/null -w '%{http_code}\n' -X POST -H "Authorization: token $TOKEN" \ -H 'Content-Type: application/json' \ -d '{"new_branch_name":"scope-probe","old_branch_name":"master"}' \ https://forge.l3x.in/api/v1/repos/alex/pi-shared/branches curl -s -o /dev/null -X DELETE -H "Authorization: token $TOKEN" \ https://forge.l3x.in/api/v1/repos/alex/pi-shared/branches/scope-probe ``` - (a) ≠ 200 → wrong/stale value in the secret. - (b) = 403/401 → PAT is **read-only**; re-create with `write:repository`+`write:issue`. - (b) = 201 → scopes are correct; update the repo secret and re-run. ## What this PR changes Replaces the validate step with a **self-diagnosing** version so the next failure names the exact cause instead of Renovate's opaque `Authentication failure`: 1. empty/unset secret → tells you the correct scopes (`write:repository`+`write:issue`, no `workflow`); 2. authenticates as the `forgejo-actions` ghost → "needs a PAT for a real account"; 3. read-only PAT → creates+deletes a probe branch; `401/403` ⇒ fatal "read-only" error, anything else ⇒ non-fatal warning. All messages drop the bogus `workflow` scope. Validated: YAML parses, `bash -n` passes, and running the step with the ghost token correctly stops at check (2) with the right message (and never mutates anything).

forgejo-actions added 1 commit

2026-06-29 10:13:31 +00:00

fix(renovate): drop non-existent 'workflow' scope; self-diagnose token issues 9c2e3ba1f2

Forgejo/Gitea has no 'workflow' scope (GitHub-only), so the previous
instructions told users to select a scope that doesn't exist. Renovate
only needs write:repository + write:issue on Forgejo.

Make the 'Validate Renovate token' step self-diagnosing so failures
point at the exact cause instead of Renovate's opaque 'Authentication
failure':
  (1) secret empty/unset -> tell exactly which scopes to use
  (2) authenticates as the forgejo-actions ghost -> needs a real user PAT
  (3) read-only PAT (write:repository missing) -> create+delete a probe
      branch; 403/401 = fatal read-only error, else non-fatal warning

Ref #1

forgejo-actions referenced this pull request

2026-06-29 10:13:49 +00:00

Update workflows #1