From 139d2021e6ed462eba73d4e0ea25e2c490134880 Mon Sep 17 00:00:00 2001 From: "Jeffrey C. Ollie" Date: Wed, 14 Oct 2026 01:43:13 -0500 Subject: [PATCH] commit as a built-in winget-bot instead of reading GET /user The submitter's token is limited to jeff/winget-pkgs, and Forgejo lets such a token have only repository and issue scopes, so it cannot read its own user. The author is now winget-bot , built in like the forge and the manifest repository. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01D31MsLkM9DkCauP1EB2zgw --- README.md | 10 +++++----- winget_submit.py | 16 ++++++++-------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 02e2e6d..3332434 100644 --- a/README.md +++ b/README.md @@ -86,11 +86,11 @@ development shell. `WINGET_BOT_TOKEN` is a token for `winget-bot`, a restricted Forgejo user with write access to `jeff/winget-pkgs` and to nothing else, which can push branches and open pull requests there but not merge them. Each program has a -token of its own, limited to `jeff/winget-pkgs` and to the `write:repository`, -`write:issue` and `read:user` scopes — the last so that the action can read -its own name and email to author the commit with. It is a secret on the -program's repository, because a workflow's own `forge.token` reaches only the -repository it runs in. +token of its own, limited to `jeff/winget-pkgs` and to the `write:repository` +and `write:issue` scopes. It is a secret on the program's repository, because a +workflow's own `forge.token` reaches only the repository it runs in. The +commit is authored as `winget-bot `, built into the +action: a token limited to one repository cannot read its own user. `tools/setup-submitter` in `jeff/winget-pkgs` sets all of this up for a program, and is run again for each new one; its CONTRIBUTING.md says how. diff --git a/winget_submit.py b/winget_submit.py index feff67d..ec40cc9 100644 --- a/winget_submit.py +++ b/winget_submit.py @@ -26,6 +26,12 @@ MANIFEST_REPOSITORY = "jeff/winget-pkgs" BASE_BRANCH = "main" USER_AGENT = "winget-submit (+https://git.jcollie.dev/jeff/winget-submit)" +# The submitter. Built in rather than read from the forge: its token is +# limited to jeff/winget-pkgs, and Forgejo lets such a token have only +# repository and issue scopes, so it cannot read its own user. +SUBMITTER = "winget-bot" +SUBMITTER_EMAIL = "winget-bot@jcollie.dev" + class SubmitError(Exception): pass @@ -194,13 +200,7 @@ def run(command: list[str], cwd: str, env: dict, capture: bool = False) -> str: def submit(inputs: Inputs, environ) -> None: forge = Forge(inputs.token) - if inputs.token: - user = forge.request("GET", "/user") - login, email = user["login"], user["email"] - else: - login, email = "winget-submit-dry-run", "winget-submit-dry-run@invalid" - - env = {**environ, **git_auth_environment(inputs.token, login)} + env = {**environ, **git_auth_environment(inputs.token, SUBMITTER)} branch = branch_name(inputs.identifier, inputs.version) with tempfile.TemporaryDirectory(dir=environ.get("RUNNER_TEMP")) as work: @@ -223,7 +223,7 @@ def submit(inputs: Inputs, environ) -> None: written = json.loads(output.strip().splitlines()[-1]) run(["git", "add", "--", written["directory"]], clone, env) - identity = ["-c", f"user.name={login}", "-c", f"user.email={email}"] + identity = ["-c", f"user.name={SUBMITTER}", "-c", f"user.email={SUBMITTER_EMAIL}"] run(["git", *identity, "commit", "--quiet", "-m", title(inputs.identifier, inputs.version)], clone, env) # `check` finds the versions to download installers for by what # differs from the base, so it runs on the commit. -- knotmirror 0.0.1