From bc9094dc6e09d0732b0ae328b7e221062d8af29d Mon Sep 17 00:00:00 2001
From: David Perl <david.perl@psi.ch>
Date: Mon, 27 Jul 2026 15:14:34 +0200
Subject: [PATCH] fix: reset git fetch auth to token

---
 .gitea/workflows/publish.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 499b221d..dc3b32dd 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -20,6 +20,7 @@ jobs:
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -31,6 +32,8 @@ jobs:
           git reset --hard ${{ github.sha }}
       - name: Evaluate | Verify upstream has NOT changed
         shell: bash
+        env:
+          MX_GITEA_BOT_TOKEN: ${{ secrets.MX_GITEA_BOT_TOKEN }}
         run: |
           set +o pipefail
 
@@ -44,6 +47,11 @@ jobs:
               exit 1
           fi
 
+          # checkout ran with persist-credentials: false, so the remote carries no
+          # credentials; give it the bot token to reach this private repo.
+          git remote set-url "${UPSTREAM_BRANCH_NAME%%/*}" \
+            "https://${MX_GITEA_BOT_TOKEN}@gitea.psi.ch/${{ github.repository }}.git"
+
           git fetch "${UPSTREAM_BRANCH_NAME%%/*}"
 
           if ! UPSTREAM_SHA="$(git rev-parse "$UPSTREAM_BRANCH_NAME")"; then
-- 
2.54.0