public/kicad-ci
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: take a read-only PAT for private submodule checkout

Browse Source 
Gitea's per-job token is scoped to the calling repo, so cross-repo
private submodules (micromelon-kicadlibs, micromelon_3d) fail with
'Repository not found'. Callers now pass SUBMODULE_TOKEN, a PAT scoped
to read:repository, through to actions/checkout.
This commit is contained in:
timmyhadwen
2026-08-23 17:58:06 +10:00
parent 236b53a129
commit 4b42299571
1 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/kibot.yml
+13 -8
View File
@@ -48,6 +48,9 @@ on:
required: true required: true
ASTABLE_API_TOKEN: ASTABLE_API_TOKEN:
required: true required: true
SUBMODULE_TOKEN:
description: "Gitea PAT (read:repository) — the job token cannot read cross-repo private submodules"
required: true
env: env:
PROJECT_NAME: ${{ inputs.project_name }} PROJECT_NAME: ${{ inputs.project_name }}
@@ -91,6 +94,7 @@ jobs:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
submodules: recursive submodules: recursive
token: ${{ secrets.SUBMODULE_TOKEN }}
- name: KiBot ERC - name: KiBot ERC
run: | run: |
[ -f "${PROJECT_NAME}/${PROJECT_NAME}.kicad_sch" ] || exit 0 [ -f "${PROJECT_NAME}/${PROJECT_NAME}.kicad_sch" ] || exit 0
@@ -123,6 +127,7 @@ jobs:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: with:
submodules: recursive submodules: recursive
token: ${{ secrets.SUBMODULE_TOKEN }}
- uses: actions/download-artifact@v3 - uses: actions/download-artifact@v3
with: with:
name: Validation name: Validation
@@ -169,7 +174,7 @@ jobs:
KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }} KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: { submodules: recursive } with: { submodules: recursive, token: '${{ secrets.SUBMODULE_TOKEN }}' }
- name: KiBot schematic PDF - name: KiBot schematic PDF
run: | run: |
export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1) export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1)
@@ -203,7 +208,7 @@ jobs:
KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }} KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: { submodules: recursive } with: { submodules: recursive, token: '${{ secrets.SUBMODULE_TOKEN }}' }
- name: KiBot BOM - name: KiBot BOM
run: | run: |
export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1) export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1)
@@ -238,7 +243,7 @@ jobs:
KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }} KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: { submodules: recursive } with: { submodules: recursive, token: '${{ secrets.SUBMODULE_TOKEN }}' }
- name: KiBot 3D (STEP) - name: KiBot 3D (STEP)
run: | run: |
export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1) export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1)
@@ -274,7 +279,7 @@ jobs:
KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }} KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: { submodules: recursive } with: { submodules: recursive, token: '${{ secrets.SUBMODULE_TOKEN }}' }
- name: KiBot gerbers - name: KiBot gerbers
run: | run: |
export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1) export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1)
@@ -308,7 +313,7 @@ jobs:
KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }} KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: { submodules: recursive } with: { submodules: recursive, token: '${{ secrets.SUBMODULE_TOKEN }}' }
- name: KiBot CPL - name: KiBot CPL
run: | run: |
export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1) export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1)
@@ -343,7 +348,7 @@ jobs:
KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }} KIBOT_VAR_rev_pcb: ${{ needs.extract_version.outputs.version }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: { submodules: recursive } with: { submodules: recursive, token: '${{ secrets.SUBMODULE_TOKEN }}' }
- name: KiBot panel - name: KiBot panel
run: | run: |
export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1) export KIBOT_VAR_name=$(echo "${PROJECT_NAME}" | cut -d"-" -f1)
@@ -393,7 +398,7 @@ jobs:
ASTABLE_API_TOKEN: ${{ secrets.ASTABLE_API_TOKEN }} ASTABLE_API_TOKEN: ${{ secrets.ASTABLE_API_TOKEN }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: { submodules: recursive } with: { submodules: recursive, token: '${{ secrets.SUBMODULE_TOKEN }}' }
- uses: actions/download-artifact@v3 - uses: actions/download-artifact@v3
with: { name: Fabrication, path: Fabrication } with: { name: Fabrication, path: Fabrication }
- uses: actions/download-artifact@v3 - uses: actions/download-artifact@v3
@@ -444,7 +449,7 @@ jobs:
ASTABLE_API_TOKEN: ${{ secrets.ASTABLE_API_TOKEN }} ASTABLE_API_TOKEN: ${{ secrets.ASTABLE_API_TOKEN }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
with: { submodules: recursive } with: { submodules: recursive, token: '${{ secrets.SUBMODULE_TOKEN }}' }
- uses: actions/download-artifact@v3 - uses: actions/download-artifact@v3
with: { name: Fabrication, path: Fabrication } with: { name: Fabrication, path: Fabrication }
- uses: actions/download-artifact@v3 - uses: actions/download-artifact@v3