Give the submitter's token only repository and issue scopes #12

Merged

jeff merged 1 commit from submitter-scopes into main

2026-10-14 01:48:45 -05:00

jeff commented

2026-10-14 01:43:57 -05:00

Owner

For #8. The first run of tools/setup-submitter jeff/clipwatch stopped at stage 5 with a bare curl: (22) ... 400. Forgejo v16 only lets a token limited to particular repositories have read/write issue and repository scopes (services/authz/access_token.go, ValidateRepositoryResource), and the wizard asked for read:user as well.

The scopes are now write:repository and write:issue. jeff/winget-submit#4 stops the action reading GET /user, and commits as a built-in winget-bot <[email protected]> instead.
curl uses --fail-with-body, and stage 5 captures each response, so a refusal shows the forge's own message rather than just a status code.
Stage 7 no longer expects the token to read its user. It now checks that it can't, which confirms the repository limit is in effect.
CONTRIBUTING lists two scopes.

Stages 1–4 completed on that first run: winget-bot exists (restricted, not an admin), it has write access here, and only jeff can merge to main. Running it again resets the bot's password and leaves those as they are.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D31MsLkM9DkCauP1EB2zgw

For #8. The first run of `tools/setup-submitter jeff/clipwatch` stopped at stage 5 with a bare `curl: (22) ... 400`. Forgejo v16 only lets a token limited to particular repositories have `read`/`write` `issue` and `repository` scopes (`services/authz/access_token.go`, `ValidateRepositoryResource`), and the wizard asked for `read:user` as well. - The scopes are now `write:repository` and `write:issue`. jeff/winget-submit#4 stops the action reading `GET /user`, and commits as a built-in `winget-bot <[email protected]>` instead. - `curl` uses `--fail-with-body`, and stage 5 captures each response, so a refusal shows the forge's own message rather than just a status code. - Stage 7 no longer expects the token to read its user. It now checks that it *can't*, which confirms the repository limit is in effect. - CONTRIBUTING lists two scopes. Stages 1–4 completed on that first run: `winget-bot` exists (restricted, not an admin), it has write access here, and only `jeff` can merge to `main`. Running it again resets the bot's password and leaves those as they are. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01D31MsLkM9DkCauP1EB2zgw

jeff added 1 commit

2026-10-14 01:43:58 -05:00

give the submitter's token only repository and issue scopes

test / test (push) Successful in 1m34s

Details

test / publish (push) Has been skipped

Details

test / test (pull_request) Successful in 1m44s

Details

test / publish (pull_request) Has been skipped

Details

27aac8aec5

Forgejo refuses read:user on a token limited to repositories, which is
why the first run of setup-submitter stopped at making the token with a
bare 400. jeff/winget-submit now commits as a built-in winget-bot rather
than reading its user, so the token needs only write:repository and
write:issue. The forge's error is now shown when it refuses, and the
check stage confirms the token cannot read its own user.

Refs #8

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01D31MsLkM9DkCauP1EB2zgw

jeff scheduled this pull request to auto merge when all checks succeed

2026-10-14 01:44:28 -05:00

jeff merged commit 4077c26f00 into main

2026-10-14 01:48:45 -05:00

jeff deleted branch submitter-scopes

2026-10-14 01:48:46 -05:00

jeff referenced this pull request from a commit

2026-10-14 01:48:46 -05:00

Merge pull request 'Give the submitter's token only repository and issue scopes' (#12) from submitter-scopes into main

jeff referenced this pull request

2026-10-14 01:50:08 -05:00

Set up the winget-bot submitter with a wizard #8