From 3f11213173d7b905b15442631c72dfb1413384f1 Mon Sep 17 00:00:00 2001
From: Philip Peterson <1326208+philip-peterson@users.noreply.github.com>
Date: Fri, 30 Oct 2026 04:14:12 -0800
Subject: [PATCH] Stage 0: build as ublue-os, and keep Forgejo's token from
 GitHub

Aurora's Justfile lists its past tags at ghcr.io/$GITHUB_REPOSITORY_OWNER
and passes $GITHUB_TOKEN to GitHub's API. Forgejo Actions sets those to
quine-global-labs and a Forgejo token: the tag lookup failed with 403
(ghcr.io/quine-global-labs/aurora doesn't exist), and GitHub would refuse
the token. Pin the owner to ublue-os; pass the token only on GitHub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Taskfile.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/Taskfile.yml b/Taskfile.yml
index f289ac0..385f576 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -65,10 +65,16 @@ tasks:
       # sudo resets PATH (just/yq/cosign often live in ~/.local/bin or brew),
       # and git refuses to read a repo owned by another user unless told it's
       # safe; Aurora's Justfile runs `git status` / `git rev-parse` here.
+      # Aurora reads its own past tags from ghcr.io/$GITHUB_REPOSITORY_OWNER,
+      # and hands $GITHUB_TOKEN to GitHub's API. On Forgejo Actions those are
+      # this org and a Forgejo token, so: always ublue-os, and the token only
+      # when the job runs on GitHub.
       - >-
-        {{.SUDO}} env "PATH=$PATH"
+        {{.SUDO}} env
+        $([ "${GITHUB_SERVER_URL:-https://github.com}" = https://github.com ] || echo -u GITHUB_TOKEN)
+        "PATH=$PATH" GITHUB_REPOSITORY_OWNER=ublue-os
         GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'
-        ${GITHUB_TOKEN:+"GITHUB_TOKEN=$GITHUB_TOKEN"}
+        $([ "${GITHUB_SERVER_URL:-https://github.com}" = https://github.com ] && [ -n "${GITHUB_TOKEN:-}" ] && echo "GITHUB_TOKEN=$GITHUB_TOKEN")
         just build --image aurora --tag {{.AURORA_TAG}} --flavor main
       # buildah builds into root's containers-storage; docker needs it copied
       # into its daemon for stage 1 to build FROM it.