Root cause: actions/checkout@v4 was not configured with explicit write
credentials (token + persist-credentials), and no git user identity
(user.name/user.email) was set. Both are required for any git push
operation in Forgejo Actions.
Changes:
- release.yml create-release job: add token: secrets.FORGEJO_TOKEN and
fetch-depth: 0 to checkout; add 'Configure git identity for push
operations' step using HTTPS credential store; add 'Smoke-test push
access' step that validates write permission via Forgejo API before
any push attempt
- ci.yml: add push-validation job that validates push credentials on
every CI run using FORGEJO_TOKEN, including credential helper
verification and API-based write permission check; add push-validation
to status-check needs and result reporting
- docs/development/ci-cd.md: add FORGEJO_TOKEN, FORGEJO_URL, and
CONTAINER_REGISTRY* secrets to the secrets table; add 'Repository
Push Authentication' section documenting root cause, fix pattern,
smoke-test step, setup instructions, and security notes; add
push-validation to CI job dependency graph and quality gates table
Design decisions:
- HTTPS token authentication (not SSH deploy keys) -- simpler to manage
- ~/.git-credentials with chmod 600 for ephemeral, secure storage
- Smoke-test validates write permission via API before push attempts
- push-validation job is independent (no needs) -- runs in parallel
- No hardcoded credentials -- all secrets via Forgejo Secrets
ISSUES CLOSED: #1541
freemo