fix(ci): unblock private docs sync from runner#72
Merged
Conversation
CI keeps failing ls-remote (falls back to voice@main) while the same token works locally. Add a one-off debug step printing length, prefix, suffix, and sha256 first-16 of the token, plus a direct ls-remote test — so we can compare CI's secret value to the local working one. To be reverted once we identify the mismatch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Token sha256 matches local byte-for-byte, so bug is runner-side. Print system+global git config, egress IP, REST API check via curl, verbose git ls-remote, and an alt URL format (oauth2:) to identify which layer is rejecting the request. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
actions/checkout@v4 was setting a local repo http.extraheader using the default repo-scoped GITHUB_TOKEN, which overrode the SYNC_DOCS_TOKEN embedded in URLs by scripts/sync-docs.js — so every clone of the private wavekat-voice repo authenticated as the (unauthorized) default token and got "Repository not found", silently falling back to main. persist-credentials: false stops checkout from setting that header. The wavekat-brand submodule is public so it still resolves without auth. No other steps in these workflows need the persisted creds. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
wavekat-eason
pushed a commit
that referenced
this pull request
May 23, 2026
🤖 I have created a release *beep* *boop* --- ## [0.0.25](wavekat-com-v0.0.24...wavekat-com-v0.0.25) (2026-05-23) ### Features * enable voice docs sync from wavekat-voice ([#70](#70)) ([7353fa3](7353fa3)) * **sync-docs:** ref override for previewing branches ([#73](#73)) ([94eeadf](94eeadf)) ### Bug Fixes * **ci:** unblock private docs sync from runner ([#72](#72)) ([a82b0ee](a82b0ee)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/checkout@v4was setting a local repohttp.extraheaderusing the default repo-scopedGITHUB_TOKEN, which overrode theSYNC_DOCS_TOKENthatscripts/sync-docs.jsembeds in clone URLs — so every clone of the privatewavekat-voicerepo silently authenticated as the wrong token, got "Repository not found", and fell back tomaininstead of pinning to a tag.persist-credentials: falseon the checkout step prevents the extraheader from being set;sync-docs.js's URL-embeddedSYNC_DOCS_TOKENbecomes the only Authorization header on the request and tag resolution works.ci.yml,preview.yml,release.yml). Thewavekat-brandsubmodule is public, so the checkout still resolves without persisted creds.Why it only failed on the self-hosted runner
Local dev machines have no leftover
extraheader, so URL creds win there. The runner inherits it fromactions/checkout. REST API calls (used bygh) bypass git config entirely, which is whygh api repos/wavekat/wavekat-voiceworked from the same runner.Test plan
npm run cf:buildresolvesvoice @ v0.0.12(will becomev0.0.13oncewavekat-voicecuts that release) instead of falling back tomain.voice @ <tag>in the sync-docs output, notvoice @ main.🤖 Generated with Claude Code