Set up the winget-bot submitter with a wizard #8

New issue

Closed

opened 2026-10-14 01:01:51 -05:00 by jeff · 1 comment

jeff commented

2026-10-14 01:01:51 -05:00

Owner

Part of #4

Set up the submitter, winget-bot, with a /wizard that walks through the steps only a person can do on the forge. Its account is used by jeff/winget-submit to push submission branches here and open pull requests.

The wizard covers:

Creating the Forgejo user winget-bot on git.jcollie.dev. It owns no repositories and belongs to no organizations, because Forgejo token scopes cover all of a user's access, not a single repository.
Adding it to jeff/winget-pkgs as a collaborator with write access. Branch protection on main already keeps it from merging or pushing there: it can push branches and open pull requests, which still need the test / test (pull_request) check and a merge by hand.
Minting an access token for it with only the write:repository and write:issue scopes.
Storing the token as the Actions secret WINGET_BOT_TOKEN on jeff/clipwatch (the first program to submit), and saying how to add it to another program later.
Checking the result: the token can push a branch to jeff/winget-pkgs and cannot push to main.

Done when

winget-bot exists with exactly that access, and jeff/clipwatch has the WINGET_BOT_TOKEN secret.

Part of #4 Set up the **submitter**, `winget-bot`, with a `/wizard` that walks through the steps only a person can do on the forge. Its account is used by `jeff/winget-submit` to push submission branches here and open pull requests. The wizard covers: 1. Creating the Forgejo user `winget-bot` on git.jcollie.dev. It owns no repositories and belongs to no organizations, because Forgejo token scopes cover all of a user's access, not a single repository. 2. Adding it to `jeff/winget-pkgs` as a collaborator with **write** access. Branch protection on `main` already keeps it from merging or pushing there: it can push branches and open pull requests, which still need the `test / test (pull_request)` check and a merge by hand. 3. Minting an access token for it with only the `write:repository` and `write:issue` scopes. 4. Storing the token as the Actions secret `WINGET_BOT_TOKEN` on `jeff/clipwatch` (the first program to submit), and saying how to add it to another program later. 5. Checking the result: the token can push a branch to `jeff/winget-pkgs` and cannot push to `main`. ## Done when `winget-bot` exists with exactly that access, and `jeff/clipwatch` has the `WINGET_BOT_TOKEN` secret.

jeff referenced this issue from jeff/clipwatch

2026-10-14 01:02:15 -05:00

Submit new versions to the JCOllie winget source #1

jeff added a new dependency

2026-10-14 01:02:20 -05:00

jeff/clipwatch#1 - Submit new versions to the JCOllie winget source

jeff referenced this issue

2026-10-14 01:02:29 -05:00

winget-submit action and winget-bot user #4

jeff added the

ready-for-human

label

2026-10-14 01:03:47 -05:00

jeff referenced this issue from jeff/winget-submit

2026-10-14 01:26:18 -05:00

Add the submit action #2

jeff referenced this issue from a commit

2026-10-14 01:35:15 -05:00

add a wizard that sets up the submitter for a program

jeff referenced this issue

2026-10-14 01:35:15 -05:00

Add a wizard that sets up the submitter for a program #11

jeff referenced this issue

2026-10-14 01:43:57 -05:00

Give the submitter's token only repository and issue scopes #12

jeff referenced this issue from a commit

2026-10-14 01:43:59 -05:00

give the submitter's token only repository and issue scopes

jeff commented

2026-10-14 01:50:08 -05:00

Author

Owner

Set up with tools/setup-submitter jeff/clipwatch (#11, fixed in #12). All of its checks passed. I then confirmed through the admin API:

winget-bot [email protected] exists. It is restricted and not an administrator.
It is a write collaborator on jeff/winget-pkgs.
On main, pushing is disabled, test / test (pull_request) is required, and only jeff can merge.
jeff/clipwatch has the WINGET_BOT_TOKEN secret. The token is winget-submit-jeff-clipwatch, limited to this repository with write:repository and write:issue.

Two changes from the plan:

No read:user scope: Forgejo won't give a token limited to repositories anything beyond repository and issue scopes, so jeff/winget-submit commits as a built-in winget-bot instead (jeff/winget-submit#4).
One token per program: a later program runs the wizard again to get its own.

Set up with `tools/setup-submitter jeff/clipwatch` (#11, fixed in #12). All of its checks passed. I then confirmed through the admin API: - `winget-bot` <[email protected]> exists. It is restricted and not an administrator. - It is a write collaborator on `jeff/winget-pkgs`. - On `main`, pushing is disabled, `test / test (pull_request)` is required, and only `jeff` can merge. - `jeff/clipwatch` has the `WINGET_BOT_TOKEN` secret. The token is `winget-submit-jeff-clipwatch`, limited to this repository with `write:repository` and `write:issue`. Two changes from the plan: - **No `read:user` scope:** Forgejo won't give a token limited to repositories anything beyond repository and issue scopes, so `jeff/winget-submit` commits as a built-in `winget-bot` instead (jeff/winget-submit#4). - **One token per program:** a later program runs the wizard again to get its own.

jeff closed this issue

2026-10-14 01:50:08 -05:00