fix(firecracker): read only BOT_BOTTLE_INFRA_ARTIFACT_TOKEN for the artifact

Drop the fallback to the general-purpose BOT_BOTTLE_CLAUDE_GITEA_TOKEN so
the artifact pull/publish uses a dedicated, package-scoped token that can
be granted (or revoked) independently of the general Gitea token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ

bot_bottle/backend/firecracker/infra_artifact.py

@@ -82,13 +82,13 @@ def infra_artifact_version(init_script: str) -> str:
 
 def _config() -> tuple[str, str, str]:
     """(base_url, owner, token) for the generic-package endpoint. Base + owner
-    are overridable for other deployments / mirrors; the token (optional — a
-    public package needs none) reuses the shared Gitea token."""
+    are overridable for other deployments / mirrors; the token comes solely from
+    `BOT_BOTTLE_INFRA_ARTIFACT_TOKEN` (a dedicated package-scoped token, kept
+    separate from the general-purpose Gitea token) and is optional — a public
+    package needs none to pull."""
     base = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_BASE", _DEFAULT_BASE).rstrip("/")
     owner = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_OWNER", _DEFAULT_OWNER)
-    token = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_TOKEN") or os.environ.get(
-        "BOT_BOTTLE_CLAUDE_GITEA_TOKEN", ""
-    )
+    token = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_TOKEN", "")
     return base, owner, token
 
 

bot_bottle/backend/firecracker/publish_infra.py

@@ -14,7 +14,7 @@ the exact artifact this produced.
   python3 -m bot_bottle.backend.firecracker.publish_infra [--dry-run] [--force]
 
 Auth: a token with `write:package` on the target owner, from
-`BOT_BOTTLE_INFRA_ARTIFACT_TOKEN` or `BOT_BOTTLE_CLAUDE_GITEA_TOKEN`.
+`BOT_BOTTLE_INFRA_ARTIFACT_TOKEN`.
 """
 
 from __future__ import annotations
@@ -114,8 +114,8 @@ def main(argv: list[str] | None = None) -> int:
     _, _, token = infra_artifact._config()
     if not args.dry_run and not token:
         raise SystemExit(
-            "no publish token: set BOT_BOTTLE_INFRA_ARTIFACT_TOKEN (or "
-            "BOT_BOTTLE_CLAUDE_GITEA_TOKEN) to a token with write:package")
+            "no publish token: set BOT_BOTTLE_INFRA_ARTIFACT_TOKEN to a token "
+            "with write:package")
 
     with tempfile.TemporaryDirectory(prefix="bb-publish-infra.") as tmp:
         version, gz, sha = build_artifact(Path(tmp))