docs(agents): a missing FORGE_PUSH_TOKEN is invisible on pull requests #4

Merged

jlxq0 merged 1 commit from fix/push-token-pitfall into master

2026-08-26 05:45:55 +00:00

jlxq0 commented

2026-08-26 05:36:53 +00:00

Owner

Fork patch. A note about this fleet's registry credentials; it means nothing upstream.

docker went red on d74a768, the merge of #3, having been green on every pull request. Cause: this repository had no FORGE_PUSH_TOKEN secret. caldav-mcp, typst-mcp and m365-mcp all have one.

The registry-login step is guarded if: github.event_name != 'pull_request', correctly — a pull request has no credentials to log in with. So the first push to master is the first run that logs in and the first that exports the layer cache, and an absent secret cannot fail before then. It would have failed the release tag too, which pushes the image.

The credential was already provisioned (jlxq0 CI bot, repository:Read + package:Read/Write); only this repository's secret was missing. Now set.

Merging this is also how the master docker job re-runs — this Forgejo exposes no rerun endpoint (actions/{tasks,runs,jobs}/{id}/rerun all 404), so whether the secret was the whole cause is answered by this merge and not before. v0.2.0 is not tagged until it is green.

**Fork patch.** A note about this fleet's registry credentials; it means nothing upstream. `docker` went red on `d74a768`, the merge of #3, having been green on every pull request. Cause: this repository had no `FORGE_PUSH_TOKEN` secret. `caldav-mcp`, `typst-mcp` and `m365-mcp` all have one. The registry-login step is guarded `if: github.event_name != 'pull_request'`, correctly — a pull request has no credentials to log in with. So the first push to `master` is the first run that logs in and the first that exports the layer cache, and an absent secret cannot fail before then. It would have failed the release tag too, which pushes the image. The credential was already provisioned (`jlxq0` CI bot, `repository:Read` + `package:Read/Write`); only this repository's secret was missing. Now set. Merging this is also how the master `docker` job re-runs — this Forgejo exposes no rerun endpoint (`actions/{tasks,runs,jobs}/{id}/rerun` all 404), so whether the secret was the whole cause is answered by this merge and not before. `v0.2.0` is not tagged until it is green.

jlxq0 added 1 commit

2026-08-26 05:36:53 +00:00

docs(agents): a missing FORGE_PUSH_TOKEN is invisible on pull requests

CI / python (pull_request) Successful in 19s

Details

CI / docker (pull_request) Successful in 10s

Details

196a5ed363

`docker` went red on `d74a768`, the merge of #3, after being green on every
pull request. This repository had no `FORGE_PUSH_TOKEN`; its five siblings all
do, and it had never had one set.

The registry-login step is guarded `if: github.event_name != 'pull_request'`,
correctly — a pull request has no credentials to log in with. The consequence
is that the first push to `master` is the first run that logs in and the first
that exports the layer cache, so an absent secret cannot fail before then. It
would have failed the release tag too, which pushes the image.

The credential was already provisioned: the `jlxq0` CI bot, `repository:Read`
plus `package:Read/Write`. Only this repository's secret was missing, now set.

Pushing this is also how the master `docker` job re-runs — this Forgejo exposes
no rerun endpoint, so the fix is verified by the next merge and not before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EfH9dv5Ub8c9PRxipsBXBe

jlxq0 merged commit 75caec3cd6 into master

2026-08-26 05:45:55 +00:00

jlxq0 deleted branch fix/push-token-pitfall

2026-08-26 05:45:55 +00:00

jlxq0 referenced this pull request from a commit

2026-08-26 05:45:56 +00:00

Merge pull request 'docs(agents): a missing FORGE_PUSH_TOKEN is invisible on pull requests' (#4) from fix/push-token-pitfall into master