From 24875c048143bd67fc9781eb4b02ee9316ff7022 Mon Sep 17 00:00:00 2001 From: debuggingfuture Date: Wed, 23 Sep 2026 13:37:06 +0800 Subject: [PATCH] feat(deploy-dispatcher-action): check out a private upstream mirror with a caller-supplied token --- actions/deploy-dispatcher-action/README.md | 18 ++++++++++++++++++ actions/deploy-dispatcher-action/action.yml | 12 ++++++++++++ 2 files changed, 30 insertions(+) diff --git a/actions/deploy-dispatcher-action/README.md b/actions/deploy-dispatcher-action/README.md index e5cf434..67406fc 100644 --- a/actions/deploy-dispatcher-action/README.md +++ b/actions/deploy-dispatcher-action/README.md @@ -117,6 +117,24 @@ See [`action.yml`](./action.yml). The required ones: | `cloudflare-api-token` | CF API token with the scopes `wrangler deploy` needs. | | `cloudflare-account-id` | 32-hex account id. | +### Deploying from a private mirror + +`upstream-repo` points the checkout at a mirror or fork. When that repo is +**private**, also pass `upstream-token`: the checkout otherwise runs on the +calling workflow's `GITHUB_TOKEN`, which is scoped to the calling repository +and reads no other private repo, org membership included. A fine-grained PAT +or App installation token with `Contents: read` on the mirror is enough. + +```yaml +with: + upstream-ref: ${{ steps.pin.outputs.sha }} + upstream-repo: my-org/flare-dispatch-mirror + upstream-token: ${{ secrets.MIRROR_READ_TOKEN }} +``` + +Left unset, the input falls back to `github.token` and a public upstream +behaves exactly as before. + --- ## Outputs diff --git a/actions/deploy-dispatcher-action/action.yml b/actions/deploy-dispatcher-action/action.yml index ae61176..758ced5 100644 --- a/actions/deploy-dispatcher-action/action.yml +++ b/actions/deploy-dispatcher-action/action.yml @@ -105,6 +105,17 @@ inputs: required: false default: flare-dispatch-upstream + upstream-token: + description: >- + Token used to check out `upstream-repo`. Defaults to the calling + workflow's `GITHUB_TOKEN`, which reads any public repo — enough for the + canonical upstream. A PRIVATE mirror needs a token that carries + `Contents: read` on it (a fine-grained PAT or a GitHub App installation + token): the caller's `GITHUB_TOKEN` is scoped to the calling repository + alone, so a private repo one namespace over is a 404 to it. + required: false + default: "" + outputs: upstream-sha: description: The 40-char SHA the upstream was checked out at. @@ -145,6 +156,7 @@ runs: repository: ${{ inputs.upstream-repo }} ref: ${{ steps.resolve-pin.outputs.sha }} path: ${{ inputs.upstream-checkout-path }} + token: ${{ inputs.upstream-token || github.token }} - name: Apply operator overlay # The overlay REPLACES upstream's wrangler.jsonc — single-file overwrite,