.gitea/workflows/documentation.yaml

@@ -14,7 +14,7 @@ permissions:
   code: read
 
 jobs:
-  generated-wiki:
+  validate-wiki:
     runs-on: ubuntu-latest
     steps:
       - name: Check out source repository
@@ -29,21 +29,38 @@ jobs:
           mkdir -p "$RUNNER_TEMP/openuf-wiki"
           python3 source/scripts/docs/generate-wiki.py --output "$RUNNER_TEMP/openuf-wiki"
           python3 source/scripts/docs/generate-wiki.py --check --output "$RUNNER_TEMP/openuf-wiki"
-      - name: Check out Wiki repository
-        if: github.event_name != 'pull_request'
+
+  publish-wiki:
+    if: gitea.event_name != 'pull_request'
+    needs: validate-wiki
+    runs-on: ubuntu-latest
+    permissions:
+      code: read
+      wiki: write
+    steps:
+      - name: Check out source repository
         uses: actions/checkout@v4
         with:
-          repository: Koda/openunifi.wiki
-          token: ${{ secrets.GITEA_TOKEN }}
-          path: wiki
+          path: source
+      - name: Clone Wiki Git repository
+        env:
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+        run: |
+          set -eu
+          repository_owner=${GITEA_REPOSITORY%%/*}
+          repository_name=${GITEA_REPOSITORY##*/}
+          wiki_name=$(printf '%s' "$repository_name" | tr '[:upper:]' '[:lower:]')
+          wiki_url="${GITEA_SERVER_URL%/}/${repository_owner}/${wiki_name}.wiki.git"
+          git clone -- "$wiki_url" wiki
       - name: Generate and verify Gitea Wiki pages
-        if: github.event_name != 'pull_request'
         run: |
           python3 source/scripts/docs/generate-wiki.py --output wiki
           python3 source/scripts/docs/generate-wiki.py --check --output wiki
       - name: Publish changed Wiki pages
-        if: github.event_name != 'pull_request'
         working-directory: wiki
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
           set -eu
           git config user.name "openUF documentation bot"
@@ -54,4 +71,5 @@ jobs:
             exit 0
           fi
           git commit -m "docs: update generated developer wiki"
-          git push origin HEAD
+          basic_auth=$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 | tr -d '\n')
+          git -c http.extraHeader="Authorization: Basic $basic_auth" push origin HEAD

README.md

@@ -71,9 +71,12 @@ so both run natively on ARM and x86 build agents.
 Publishing is an explicit authenticated step: `./scripts/docs/publish-wiki.sh`.
 The script derives the lowercase `.wiki.git` repository URL from `origin`,
 checks it out before generating, and accepts an explicit URL override. No
-credentials are stored in this repository. The documentation workflow performs
-the same two-checkout process and requires `GITEA_TOKEN` to have write access to
-`Koda/openunifi.wiki`.
+credentials are stored in this repository. The documentation workflow clones the
+Wiki Git endpoint directly because it is not a normal API repository. Its
+publishing job requests Gitea's `wiki: write` permission for `GITEA_TOKEN` and
+passes the token through a transient HTTP authentication header. Repository
+Actions settings must allow Wiki write access because Gitea clamps requested
+job permissions to the configured maximum.
 
 ## Automated releases