docs: the server runs Gitea 1.27.2, not 1.24.2; say what it actually honours #61

2026-10-06T03:11:02Z

ekklesia-bot commented

2026-10-06 03:11:02 +00:00

docs: the server runs Gitea 1.27.2, not 1.24.2; say what it actually honours

The CI documentation, the workflow header, the README, ADR 0047 and scripts/ci-sweep.sh all said the server was Gitea 1.24.2, which ignores permissions, concurrency and timeout-minutes. The server reports 1.27.2 (GET /api/v1/version). Every claim is now stated from what is verified on this server:

Claim	Status here	Evidence
`concurrency`	honoured	Since 1.26 (gitea#32751). Observed: run 133 cancelled when run 134 started for the same PR, and run 135 when run 137 did
`permissions`	supported by 1.27 with Gitea's own scopes (1.27 comparison), not verified here	The token-permission settings are not exposed through the API (`/actions/permissions` and `/actions/settings` return 404). Nothing claims the job token is read-only
`timeout-minutes`	no longer listed as unsupported, not verified here	Teardown still relies on the stack sweep and a runner-side reaper
`environment`, complex `runs-on`	still ignored or unsupported	1.27 comparison page

What changes

security.md:
- the server version (with the date it was checked);
- "What Gitea 1.24 ignores" is replaced by What this server honours, and what is not yet verified;
- untrusted-contribution requirement 1 (upgrade to the 1.26 line or later) is marked done; items 2–3, configuring and proving token authority, remain; item 4 is narrowed to timeout and teardown.
.github/workflows/ci.yml: the header comment only. No behaviour change.
README.md: the outstanding operational items, restated.
ADR 0047 (still Proposed): its "docker run, not a reusable workflow" reasons are restated for 1.27, where private sources are supported. They hold without the 1.24 argument: thin support in practice, and a harness whose behaviour would otherwise depend on how the server expands it.
scripts/ci-sweep.sh: comment only.

Not in this PR

Proving the job token's authority on this server (requirement 3) needs the server's Actions settings and a deliberate test. That's operational work, not a doc edit.
Signage's workflow header carries the same stale line. It is corrected in the Signage CI-speed PR, which touches that file anyway.

Verification

tests/ci-scripts.test.ts passes, and bash -n passes on the edited script. No other code changes.

🤖 Generated with Claude Code

## docs: the server runs Gitea 1.27.2, not 1.24.2; say what it actually honours The CI documentation, the workflow header, the README, ADR 0047 and `scripts/ci-sweep.sh` all said the server was **Gitea 1.24.2**, which ignores `permissions`, `concurrency` and `timeout-minutes`. The server reports **1.27.2** (`GET /api/v1/version`). Every claim is now stated from what is verified **on this server**: | Claim | Status here | Evidence | |---|---|---| | `concurrency` | **honoured** | Since 1.26 ([gitea#32751](https://github.com/go-gitea/gitea/pull/32751)). Observed: run 133 cancelled when run 134 started for the same PR, and run 135 when run 137 did | | `permissions` | supported by 1.27 with Gitea's own scopes ([1.27 comparison](https://docs.gitea.com/1.27/usage/actions/comparison)), **not verified here** | The token-permission settings are not exposed through the API (`/actions/permissions` and `/actions/settings` return 404). Nothing claims the job token is read-only | | `timeout-minutes` | no longer listed as unsupported, **not verified here** | Teardown still relies on the stack sweep and a runner-side reaper | | `environment`, complex `runs-on` | still ignored or unsupported | 1.27 comparison page | ### What changes - **`security.md`:** - the server version (with the date it was checked); - "What Gitea 1.24 ignores" is replaced by *What this server honours, and what is not yet verified*; - untrusted-contribution requirement 1 (upgrade to the 1.26 line or later) is marked **done**; items 2–3, configuring and proving token authority, remain; item 4 is narrowed to timeout and teardown. - **`.github/workflows/ci.yml`:** the header comment only. No behaviour change. - **`README.md`:** the outstanding operational items, restated. - **ADR 0047 (still Proposed):** its "`docker run`, not a reusable workflow" reasons are restated for 1.27, where private sources are supported. They hold without the 1.24 argument: thin support in practice, and a harness whose behaviour would otherwise depend on how the server expands it. - **`scripts/ci-sweep.sh`:** comment only. ### Not in this PR - Proving the job token's authority on this server (requirement 3) needs the server's Actions settings and a deliberate test. That's operational work, not a doc edit. - Signage's workflow header carries the same stale line. It is corrected in the Signage CI-speed PR, which touches that file anyway. ### Verification `tests/ci-scripts.test.ts` passes, and `bash -n` passes on the edited script. No other code changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ekklesia-bot added 1 commit 2026-10-06 03:11:02 +00:00

docs: the server runs Gitea 1.27.2, not 1.24.2; say what it actually honours

CI / verify (pull_request) Successful in 54s

Details

CI / infrastructure-smoke (pull_request) Successful in 37s

Details

CI / migration-smoke (pull_request) Successful in 1m50s

Details

CI / image-build (pull_request) Successful in 18s

Details

CI / deploy-smoke (same-origin) (pull_request) Successful in 42s

Details

CI / deploy-smoke (split) (pull_request) Successful in 1m1s

Details

0ec1755279

The CI documentation, the workflow header, the README, ADR 0047 and the
sweep's comment all said the server was Gitea 1.24.2, which ignores
`permissions`, `concurrency` and `timeout-minutes`. The server reports
1.27.2 (GET /api/v1/version).

Each claim is now stated from what is verified on this server:
- `concurrency` is honoured, observed: Ekklesia runs 133 and 135 were
  cancelled when a newer run started for the same pull request;
- `permissions` is supported by 1.27 with Gitea's own scopes, but the
  token's actual authority is not visible through the API and not yet
  proven, so nothing claims the job token is read-only;
- `timeout-minutes` is no longer listed as unsupported, but is not
  verified, and teardown still relies on the stack sweep and a reaper.

Requirement 1 for executing untrusted contributions (upgrade to the
1.26 line or later) is marked done; items 2 and 3, configuring and
proving token authority, remain. ADR 0047 (still Proposed) restates
its "docker run, not a reusable workflow" reasons for 1.27, where
private sources are supported. The reasons still hold without the 1.24
argument.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Zayin_Admin approved these changes

2026-10-06 03:50:25 +00:00

Zayin_Admin merged commit 12dca3e8a4 into main

2026-10-06 03:50:31 +00:00

Zayin_Admin deleted branch docs/gitea-1.27-ci-facts

2026-10-06 03:50:31 +00:00

Zayin_Admin referenced this issue from a commit

2026-10-06 03:56:37 +00:00

chore(release): prepare 0.1.2

ekklesia-bot referenced this pull request

2026-10-06 03:56:48 +00:00

chore(release): prepare 0.1.2 #62