didericis/bot-bottle
1
0
Fork 0
Code Issues 35 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

fix(firecracker): read only BOT_BOTTLE_INFRA_ARTIFACT_TOKEN for the artifact
lint / lint (push) Successful in 2m37s
Details
test / unit (pull_request) Successful in 1m25s
Details
test / integration (pull_request) Successful in 31s
Details
test / coverage (pull_request) Successful in 1m31s
Details

Browse Source 
Drop the fallback to the general-purpose BOT_BOTTLE_CLAUDE_GITEA_TOKEN so
the artifact pull/publish uses a dedicated, package-scoped token that can
be granted (or revoked) independently of the general Gitea token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ
This commit is contained in:
didericis
2026-07-16 23:31:17 -04:00
parent 18f190b7e3
commit 8d8a88aeeb
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bot_bottle/backend/firecracker/infra_artifact.py
+5 -5
View File
@@ -82,13 +82,13 @@ def infra_artifact_version(init_script: str) -> str:
def _config() -> tuple[str, str, str]: def _config() -> tuple[str, str, str]:
"""(base_url, owner, token) for the generic-package endpoint. Base + owner """(base_url, owner, token) for the generic-package endpoint. Base + owner
are overridable for other deployments / mirrors; the token (optional — a are overridable for other deployments / mirrors; the token comes solely from
public package needs none) reuses the shared Gitea token.""" `BOT_BOTTLE_INFRA_ARTIFACT_TOKEN` (a dedicated package-scoped token, kept
separate from the general-purpose Gitea token) and is optional — a public
package needs none to pull."""
base = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_BASE", _DEFAULT_BASE).rstrip("/") base = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_BASE", _DEFAULT_BASE).rstrip("/")
owner = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_OWNER", _DEFAULT_OWNER) owner = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_OWNER", _DEFAULT_OWNER)
token = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_TOKEN") or os.environ.get( token = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_TOKEN", "")
"BOT_BOTTLE_CLAUDE_GITEA_TOKEN", ""
)
return base, owner, token return base, owner, token
bot_bottle/backend/firecracker/publish_infra.py
+3 -3
View File
@@ -14,7 +14,7 @@ the exact artifact this produced.
python3 -m bot_bottle.backend.firecracker.publish_infra [--dry-run] [--force] python3 -m bot_bottle.backend.firecracker.publish_infra [--dry-run] [--force]
Auth: a token with `write:package` on the target owner, from Auth: a token with `write:package` on the target owner, from
`BOT_BOTTLE_INFRA_ARTIFACT_TOKEN` or `BOT_BOTTLE_CLAUDE_GITEA_TOKEN`. `BOT_BOTTLE_INFRA_ARTIFACT_TOKEN`.
""" """
from __future__ import annotations from __future__ import annotations
@@ -114,8 +114,8 @@ def main(argv: list[str] | None = None) -> int:
_, _, token = infra_artifact._config() _, _, token = infra_artifact._config()
if not args.dry_run and not token: if not args.dry_run and not token:
raise SystemExit( raise SystemExit(
"no publish token: set BOT_BOTTLE_INFRA_ARTIFACT_TOKEN (or " "no publish token: set BOT_BOTTLE_INFRA_ARTIFACT_TOKEN to a token "
"BOT_BOTTLE_CLAUDE_GITEA_TOKEN) to a token with write:package") "with write:package")
with tempfile.TemporaryDirectory(prefix="bb-publish-infra.") as tmp: with tempfile.TemporaryDirectory(prefix="bb-publish-infra.") as tmp:
version, gz, sha = build_artifact(Path(tmp)) version, gz, sha = build_artifact(Path(tmp))