secrets.GITEA_TOKEN is reserved in Gitea Actions — it resolves to the auto-generated per-run token, whose scopes are capped by the workflow permissions: block (contents: read). The merge endpoint requires contents:write → every merge attempt 403s → fail-loud robot refuses the job. Repo secrets list was EMPTY ([]) — no override existed.
Fix
One line: authenticate via secrets.ROBOT_TOKEN (conductor token, created via API, admin-scoped, passes /user identity check).
Hardening note (follow-up)
Conductor admin token in a CI secret is acceptable for a private repo but over-privileged; a dedicated scoped token (repository:write + issue:write + user:read) minted via UI is the follow-up.
## Root cause (18 consecutive loud failures)
`secrets.GITEA_TOKEN` is **reserved** in Gitea Actions — it resolves to the auto-generated per-run token, whose scopes are capped by the workflow `permissions:` block (`contents: read`). The merge endpoint requires contents:write → every merge attempt 403s → fail-loud robot refuses the job. Repo secrets list was EMPTY (`[]`) — no override existed.
## Fix
One line: authenticate via `secrets.ROBOT_TOKEN` (conductor token, created via API, admin-scoped, passes `/user` identity check).
## Hardening note (follow-up)
Conductor admin token in a CI secret is acceptable for a private repo but over-privileged; a dedicated scoped token (repository:write + issue:write + user:read) minted via UI is the follow-up.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Root cause (18 consecutive loud failures)
secrets.GITEA_TOKENis reserved in Gitea Actions — it resolves to the auto-generated per-run token, whose scopes are capped by the workflowpermissions:block (contents: read). The merge endpoint requires contents:write → every merge attempt 403s → fail-loud robot refuses the job. Repo secrets list was EMPTY ([]) — no override existed.Fix
One line: authenticate via
secrets.ROBOT_TOKEN(conductor token, created via API, admin-scoped, passes/useridentity check).Hardening note (follow-up)
Conductor admin token in a CI secret is acceptable for a private repo but over-privileged; a dedicated scoped token (repository:write + issue:write + user:read) minted via UI is the follow-up.