Release publish blocked on two ungranted secrets: CI_RELEASE_TOKEN write:package (ineffective) + SCOOP_WRITE_TOKEN (unset) #576

New issue

Closed

opened 2026-07-03 17:54:01 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-07-03 17:54:01 +00:00

Owner

Two ungranted secrets block the release publish path

Surfaced by the v0.363/364.0 release runs from ward#571 and ward#572. Both are human credential actions - not agent-dispatchable.

1. `CI_RELEASE_TOKEN` `write:package` scope is still ineffective (correcting the infra#452 assumption)

On the v0.364.0 release, both publish-kdl-read and publish-kdl-write failed at the identical second (17:37:35, ~2m13s each). Two parallel jobs dying together is the token-PUT wall, not two build bugs - publish-kdl-write is unchanged, proven code. The generic registry did not fill: ward-kdl-{read,write}-linux-{amd64,arm64} all 404 at v0.364.0.

So despite infra#448/#452 rotating the scope, the grant is not effective in practice - this is infra#452 trap #7 (verify the payoff, not the write) biting exactly. Earlier this session I reported the token as "already handled"; the release run disproves it.

Human action: verify/fix write:package on CI_RELEASE_TOKEN, then any next push to main publishes both tiers. No headless rerun exists (Forgejo 15.0.2, infra#452 trap #6) - it needs a fresh push after the fix.

2. `SCOOP_WRITE_TOKEN` is unset

ward#571 wired a release-time bump-scoop-manifest job that writes bucket/ward.json to the Forgejo scoop bucket (coilyco-bridge/scoop-bucket) each tag. It needs a SCOOP_WRITE_TOKEN with push scope to that bucket. Unset, the job goes red on an otherwise-green release (deliberate fail-loud, matching the tap job's stance).

Human action: provision SCOOP_WRITE_TOKEN before the next release.

Scoop premise correction (context)

ward#571 found the bucket had no ward.json and no daily cron - the earlier codex windows-scoop work never landed. So #571 creates the manifest from scratch and pushes to Forgejo (the bucket is Forgejo-canonical: users scoop bucket add from forgejo.coilysiren.me and checkver reads the Forgejo releases.atom). Pushing the GitHub mirror alone would not clear the lag.

ward#571 (scoop push job), ward#572 (publish-kdl-read), infra#448 / infra#452 (the write:package rotation that did not take effect).

## Two ungranted secrets block the release publish path Surfaced by the v0.363/364.0 release runs from ward#571 and ward#572. Both are **human credential actions** - not agent-dispatchable. ### 1. `CI_RELEASE_TOKEN` `write:package` scope is still **ineffective** (correcting the infra#452 assumption) On the v0.364.0 release, **both** `publish-kdl-read` and `publish-kdl-write` failed at the **identical second** (17:37:35, ~2m13s each). Two parallel jobs dying together is the token-PUT wall, not two build bugs - `publish-kdl-write` is unchanged, proven code. The generic registry did **not** fill: `ward-kdl-{read,write}-linux-{amd64,arm64}` all 404 at v0.364.0. So despite infra#448/#452 rotating the scope, the grant is **not effective in practice** - this is infra#452 **trap #7 (verify the payoff, not the write)** biting exactly. Earlier this session I reported the token as "already handled"; the release run disproves it. **Human action:** verify/fix `write:package` on `CI_RELEASE_TOKEN`, then any next push to main publishes both tiers. No headless rerun exists (Forgejo 15.0.2, infra#452 trap #6) - it needs a fresh push after the fix. ### 2. `SCOOP_WRITE_TOKEN` is unset ward#571 wired a release-time `bump-scoop-manifest` job that writes `bucket/ward.json` to the Forgejo scoop bucket (`coilyco-bridge/scoop-bucket`) each tag. It needs a `SCOOP_WRITE_TOKEN` with push scope to that bucket. Unset, the job goes **red on an otherwise-green release** (deliberate fail-loud, matching the tap job's stance). **Human action:** provision `SCOOP_WRITE_TOKEN` before the next release. ### Scoop premise correction (context) ward#571 found the bucket had **no `ward.json` and no daily cron** - the earlier codex windows-scoop work never landed. So #571 creates the manifest from scratch and pushes to **Forgejo** (the bucket is Forgejo-canonical: users `scoop bucket add` from `forgejo.coilysiren.me` and checkver reads the Forgejo releases.atom). Pushing the GitHub mirror alone would not clear the lag. ### Related - ward#571 (scoop push job), ward#572 (publish-kdl-read), infra#448 / infra#452 (the `write:package` rotation that did not take effect).

coilysiren commented

2026-07-03 21:36:27 +00:00

Author

Owner

CI_RELEASE_TOKEN half: RESOLVED

Kai set a fresh write:repositorywrite:package token as the ward repo secret and re-ran the failed publish-kdl jobs on run 882 (v0.381.0). Result: all four packages now 200 - ward-kdl-{write,read}-linux-{amd64,arm64} @ v0.381.0. It was a scope/timing issue, not a package-permission 403, so no org package-write grant was needed.

Every future ward release now auto-publishes both tiers. This also brings the ward-kdl read-only observe surface (ward#547 install + ward#572 producer) to life once a director container pulls a release >= v0.381.0.

Remaining: the SCOOP_WRITE_TOKEN half - bump-scoop-manifest still fails (token unset). That rides infra#456 (scoop rotation via --aws), in flight.

## CI_RELEASE_TOKEN half: RESOLVED Kai set a fresh `write:repositorywrite:package` token as the ward repo secret and re-ran the failed publish-kdl jobs on run 882 (v0.381.0). Result: **all four packages now 200** - `ward-kdl-{write,read}-linux-{amd64,arm64}` @ v0.381.0. It was a scope/timing issue, not a package-permission 403, so no org package-write grant was needed. Every future ward release now auto-publishes both tiers. This also brings the ward-kdl read-only observe surface (ward#547 install + ward#572 producer) to life once a director container pulls a release >= v0.381.0. **Remaining:** the `SCOOP_WRITE_TOKEN` half - `bump-scoop-manifest` still fails (token unset). That rides infra#456 (scoop rotation via --aws), in flight.

coilysiren commented

2026-07-03 21:46:22 +00:00

Author

Owner

Both halves RESOLVED - release-publish blocker cleared

CI half (done earlier): fresh write:repository + write:package token set as the ward repo secret; all four ward-kdl-{write,read}-linux-{amd64,arm64} publish (200 at v0.381.0).

SCOOP half (done now):

Root cause of the persistent bump-scoop-manifest failure was NOT just the unset token - the job pointed at coilyco-bridge/scoop-bucket, which is archived (push 403). Fixed in ward#589 to the live coilyco-flight-deck/scoop-bucket.
After ward#589 landed: release v0.382.0, bump-scoop-manifest task 4439 SUCCESS (run 884), and coilyco-flight-deck/scoop-bucket now serves bucket/ward.json at version 0.382.0 (current, pointing at flight-deck releases).
The SCOOP_WRITE_TOKEN Kai set has confirmed push to the flight-deck bucket.

Every future ward release now publishes the kdl package tiers and bumps the scoop manifest to the correct bucket. scoop update ward on Windows serves current builds (the original ward#571 goal), and the pull-not-push lag is fixed end to end.

Closing - both secrets granted and both publish paths green.

## Both halves RESOLVED - release-publish blocker cleared **CI half (done earlier):** fresh write:repository + write:package token set as the ward repo secret; all four ward-kdl-{write,read}-linux-{amd64,arm64} publish (200 at v0.381.0). **SCOOP half (done now):** - Root cause of the persistent bump-scoop-manifest failure was NOT just the unset token - the job pointed at **coilyco-bridge/scoop-bucket, which is archived** (push 403). Fixed in ward#589 to the live **coilyco-flight-deck/scoop-bucket**. - After ward#589 landed: release v0.382.0, bump-scoop-manifest task 4439 **SUCCESS** (run 884), and coilyco-flight-deck/scoop-bucket now serves **bucket/ward.json at version 0.382.0** (current, pointing at flight-deck releases). - The SCOOP_WRITE_TOKEN Kai set has confirmed push to the flight-deck bucket. Every future ward release now publishes the kdl package tiers and bumps the scoop manifest to the correct bucket. `scoop update ward` on Windows serves current builds (the original ward#571 goal), and the pull-not-push lag is fixed end to end. Closing - both secrets granted and both publish paths green.

coilysiren closed this issue

2026-07-03 21:46:22 +00:00