From ee735f2e2ed4a73c8372598fde7fd54bd9d45ee0 Mon Sep 17 00:00:00 2001 From: weichen Date: Wed, 14 Oct 2026 16:08:41 +0000 Subject: [PATCH] Use dedicated read access for private UI CI dependency Why: Gitea job token can fetch Frontend but receives repository-not-found for private UI. Evidence: PR CI run 3213 checkout log shows Frontend fetch succeeded and UI fetch failed; Frontend secret listing lacks SUBMODULE_TOKEN. Impact: CI now requests the dedicated UI read credential and fails clearly until it is provisioned. Refs: IAM U3 Frontend PR #86 --- .gitea/workflows/ci.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index c18a177..cbf9e93 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -12,6 +12,7 @@ jobs: - name: Check out fixed Frontend and UI commits env: TOKEN: ${{ secrets.GITHUB_TOKEN }} + UI_TOKEN: ${{ secrets.SUBMODULE_TOKEN }} UI_SHA: 7c35a78abc8ef7db6fb2d508b2971d59a90de964 run: | set -euo pipefail @@ -21,6 +22,10 @@ jobs: [[ "${GITHUB_SHA}" =~ ^[0-9a-f]{40}$ ]] [[ "${UI_SHA}" =~ ^[0-9a-f]{40}$ ]] test -n "${TOKEN}" + if [ -z "${UI_TOKEN}" ]; then + echo "SUBMODULE_TOKEN is required for the private UI dependency" >&2 + exit 1 + fi export GIT_TERMINAL_PROMPT=0 mkdir -p "${RUNNER_TEMP}/iam-frontend-ci/frontend" "${RUNNER_TEMP}/iam-frontend-ci/ui" cd "${RUNNER_TEMP}/iam-frontend-ci/frontend" @@ -32,7 +37,7 @@ jobs: cd "${RUNNER_TEMP}/iam-frontend-ci/ui" git init -q git remote add origin "${GITHUB_SERVER_URL}/weichen/Agent-System-UI.git" - git -c http.extraheader="AUTHORIZATION: token ${TOKEN}" fetch --depth=1 origin "${UI_SHA}" + git -c http.extraheader="AUTHORIZATION: token ${UI_TOKEN}" fetch --depth=1 origin "${UI_SHA}" git checkout -q --detach FETCH_HEAD test "$(git rev-parse HEAD)" = "${UI_SHA}" git -C "${RUNNER_TEMP}/iam-frontend-ci/frontend" status --short