Add a wizard that sets up the submitter for a program #11

Merged

jeff merged 1 commit from setup-submitter into main

2026-10-14 01:38:23 -05:00

jeff commented

2026-10-14 01:35:15 -05:00

Owner

For #8. #8 closes once the wizard has been run for jeff/clipwatch.

tools/setup-submitter <owner>/<repo> is run by an administrator, with fj logged in. Each stage either checks something or confirms before changing anything:

Checks fj is logged in as an administrator and the program's repository exists.
Creates winget-bot (restricted, max_repo_creation: 0, no organizations), or resets its password if it already exists. The password is random and is kept only while the wizard runs.
Makes it a write collaborator on jeff/winget-pkgs.
Allows only jeff to merge to main. Today's protection blocks direct pushes and requires the check, but has no merge whitelist, so anyone with write access could merge a passing pull request. That would have included the bot.
Makes a token for that one program, winget-submit-<owner>-<repo>, limited to jeff/winget-pkgs through Forgejo 16's repository-specific tokens. Scopes: write:repository, write:issue, and read:user, which jeff/winget-submit needs to read its own name and email for the commit. The password reaches curl on stdin, never the command line, and the token is never printed.
Sets the token as WINGET_BOT_TOKEN on the program with fj secret set.
Uses the token to check it can do what the action does (read its user, list pull requests, create and delete a branch), that user_can_push and user_can_merge on main are false, and that it can't reach the program's own repository.

A token per program means one can be revoked without touching the others, and the wizard is re-run for each new program. CONTRIBUTING describes it, and the devshell gains curl and jq. bash -n passes. Shellcheck's only findings are info notes about library functions this wizard doesn't use, plus one false positive inside the library, which comes from mattpocock/skills 1.3.1 (MIT) and is unchanged. Its copyright is credited in the SPDX header.

Not yet run. Running it is the first real test of stages 2–7.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D31MsLkM9DkCauP1EB2zgw

For #8. #8 closes once the wizard has been run for `jeff/clipwatch`. `tools/setup-submitter <owner>/<repo>` is run by an administrator, with `fj` logged in. Each stage either checks something or confirms before changing anything: 1. Checks `fj` is logged in as an administrator and the program's repository exists. 2. Creates `winget-bot` (`restricted`, `max_repo_creation: 0`, no organizations), or resets its password if it already exists. The password is random and is kept only while the wizard runs. 3. Makes it a write collaborator on `jeff/winget-pkgs`. 4. **Allows only `jeff` to merge to `main`.** Today's protection blocks direct pushes and requires the check, but has no merge whitelist, so anyone with write access could merge a passing pull request. That would have included the bot. 5. Makes a token for that one program, `winget-submit-<owner>-<repo>`, limited to `jeff/winget-pkgs` through Forgejo 16's repository-specific tokens. Scopes: `write:repository`, `write:issue`, and `read:user`, which `jeff/winget-submit` needs to read its own name and email for the commit. The password reaches curl on stdin, never the command line, and the token is never printed. 6. Sets the token as `WINGET_BOT_TOKEN` on the program with `fj secret set`. 7. Uses the token to check it can do what the action does (read its user, list pull requests, create and delete a branch), that `user_can_push` and `user_can_merge` on `main` are false, and that it can't reach the program's own repository. A token per program means one can be revoked without touching the others, and the wizard is re-run for each new program. CONTRIBUTING describes it, and the devshell gains `curl` and `jq`. `bash -n` passes. Shellcheck's only findings are info notes about library functions this wizard doesn't use, plus one false positive inside the library, which comes from mattpocock/skills 1.3.1 (MIT) and is unchanged. Its copyright is credited in the SPDX header. Not yet run. Running it is the first real test of stages 2–7. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01D31MsLkM9DkCauP1EB2zgw

jeff added 1 commit

2026-10-14 01:35:15 -05:00

add a wizard that sets up the submitter for a program

test / test (push) Successful in 1m52s

Details

test / publish (push) Has been skipped

Details

test / test (pull_request) Successful in 1m44s

Details

test / publish (pull_request) Has been skipped

Details

74d8ff81c1

tools/setup-submitter <owner>/<repo> creates winget-bot if needed, as a
restricted user that can create no repositories or organizations, makes
it a write collaborator here, restricts merging to main to jeff, makes a
token for that one program limited to this repository, stores it as the
program's WINGET_BOT_TOKEN, and checks what the token can and cannot do.

The token has read:user beside write:repository and write:issue, because
jeff/winget-submit reads its own user to author the commit. The wizard
library above its STAGES marker is from mattpocock/skills, unchanged.

Refs #8

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01D31MsLkM9DkCauP1EB2zgw

jeff referenced this pull request from jeff/winget-submit

2026-10-14 01:35:29 -05:00

Describe the submitter's per-program token #3

jeff merged commit 9fd1181114 into main

2026-10-14 01:38:23 -05:00

jeff referenced this pull request from a commit

2026-10-14 01:38:23 -05:00

Merge pull request 'Add a wizard that sets up the submitter for a program' (#11) from setup-submitter into main

jeff referenced this pull request

2026-10-14 01:50:08 -05:00

Set up the winget-bot submitter with a wizard #8