diff --git a/README.md b/README.md index b18237e..cccf7df 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,9 @@ Note: `workflow_call` across private repos was abandoned — the auto-generated MediaWiki BotPassword issued for user `Mikkeli`, bot name `giteaBot`. Login form: `Mikkeli@giteaBot`. -Both this and the previous `Dubrowski` identity hold the `bot` right, so pipeline edits stay flagged as bot edits and keep out of default Recent Changes — `mwclient`'s `page.save()` requests the bot flag and the wiki honours it. +`Mikkeli` holds the `bot` right, so pipeline edits are flagged as bot edits and stay out of default Recent Changes — `mwclient`'s `page.save()` requests the bot flag and the wiki honours it. + +This section previously named `Dubrowski@giteaAutomaton`, but every bot-flagged revision in the wiki's history is attributed to `Mikkeli`, so that had been stale for some time — the live secret never matched the doc. Credentials are stored in the Gitea org-scope secret vault under `novoyuuparosk-wiki` (`WIKI_BOT_USER`, `WIKI_BOT_PASSWORD`). Not stored in this repo. @@ -86,7 +88,9 @@ Secrets and variables are scoped to the `novoyuuparosk-wiki` org, inherited by a | Runner execution | Docker, added as a service to the existing Gitea docker-compose | 2026-06-09 | | Runner network mode | `host` — job containers need to reach Gitea on localhost | 2026-06-09 | | Secret/runner scope | User-level on `mikkeli` (no orgs on this instance) | 2026-06-09 | -| Ownership | This repo and all three source repos moved to the `novoyuuparosk-wiki` org. Keeping caller and callee under one owner avoids the cross-owner read gate on private reusable workflows (Settings → Actions → General → collaborative owners, Gitea 1.26+). Secrets/variables re-created at org scope; runner must serve org-owned runs | 2026-08-11 | +| Ownership | This repo and all three source repos moved to the `novoyuuparosk-wiki` org. Secrets/variables re-created at org scope; runner re-registered instance-level so it serves org-owned runs | 2026-08-11 | +| **This repo must stay public** | `act_runner` resolves a cross-repo `uses:` by cloning the callee **anonymously** — the job token is not applied. A private callee therefore 404s with `repository not found`, regardless of the caller sharing its owner. Shared ownership does **not** satisfy the read requirement. Alternative if it must be private again: Settings → Actions → General → collaborative owners (Gitea 1.26+), untested here | 2026-08-11 | +| Runner cache masks this | The resolved callee is cached at `/root/.cache/act/-@`. Changing owner changes the key, so a working pipeline can break on a clone that had been served from cache for months. Suspect the cache before suspecting permissions | 2026-08-11 | | Container registry | Packages are not transferable in Gitea, so images stay at `pi5-16.local:3005/mikkeli/*` for now. Registry auth still uses the `mikkeli`-owned `PKGRW_PAT` | 2026-08-11 | | MediaWiki API path | `api.php` (classic action API) | 2026-06-09 | | Branch naming (this repo) | `automation/` for pipeline-development branches | 2026-06-09 |