From a73aba935f03743bfac9ef0eeef5af2f2b58e6fe Mon Sep 17 00:00:00 2001 From: didericis Date: Thu, 16 Jul 2026 23:31:17 -0400 Subject: [PATCH] fix(firecracker): read only BOT_BOTTLE_INFRA_ARTIFACT_TOKEN for the artifact Drop the fallback to the general-purpose BOT_BOTTLE_CLAUDE_GITEA_TOKEN so the artifact pull/publish uses a dedicated, package-scoped token that can be granted (or revoked) independently of the general Gitea token. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ --- bot_bottle/backend/firecracker/infra_artifact.py | 10 +++++----- bot_bottle/backend/firecracker/publish_infra.py | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/bot_bottle/backend/firecracker/infra_artifact.py b/bot_bottle/backend/firecracker/infra_artifact.py index 5c0d046..d8af7ee 100644 --- a/bot_bottle/backend/firecracker/infra_artifact.py +++ b/bot_bottle/backend/firecracker/infra_artifact.py @@ -82,13 +82,13 @@ def infra_artifact_version(init_script: str) -> str: def _config() -> tuple[str, str, str]: """(base_url, owner, token) for the generic-package endpoint. Base + owner - are overridable for other deployments / mirrors; the token (optional — a - public package needs none) reuses the shared Gitea token.""" + are overridable for other deployments / mirrors; the token comes solely from + `BOT_BOTTLE_INFRA_ARTIFACT_TOKEN` (a dedicated package-scoped token, kept + separate from the general-purpose Gitea token) and is optional — a public + package needs none to pull.""" base = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_BASE", _DEFAULT_BASE).rstrip("/") owner = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_OWNER", _DEFAULT_OWNER) - token = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_TOKEN") or os.environ.get( - "BOT_BOTTLE_CLAUDE_GITEA_TOKEN", "" - ) + token = os.environ.get("BOT_BOTTLE_INFRA_ARTIFACT_TOKEN", "") return base, owner, token diff --git a/bot_bottle/backend/firecracker/publish_infra.py b/bot_bottle/backend/firecracker/publish_infra.py index 3acdd65..ae67b23 100644 --- a/bot_bottle/backend/firecracker/publish_infra.py +++ b/bot_bottle/backend/firecracker/publish_infra.py @@ -14,7 +14,7 @@ the exact artifact this produced. python3 -m bot_bottle.backend.firecracker.publish_infra [--dry-run] [--force] Auth: a token with `write:package` on the target owner, from -`BOT_BOTTLE_INFRA_ARTIFACT_TOKEN` or `BOT_BOTTLE_CLAUDE_GITEA_TOKEN`. +`BOT_BOTTLE_INFRA_ARTIFACT_TOKEN`. """ from __future__ import annotations @@ -114,8 +114,8 @@ def main(argv: list[str] | None = None) -> int: _, _, token = infra_artifact._config() if not args.dry_run and not token: raise SystemExit( - "no publish token: set BOT_BOTTLE_INFRA_ARTIFACT_TOKEN (or " - "BOT_BOTTLE_CLAUDE_GITEA_TOKEN) to a token with write:package") + "no publish token: set BOT_BOTTLE_INFRA_ARTIFACT_TOKEN to a token " + "with write:package") with tempfile.TemporaryDirectory(prefix="bb-publish-infra.") as tmp: version, gz, sha = build_artifact(Path(tmp))