From 5b32539d658f43b4b616dc24cbaad8a8910251e4 Mon Sep 17 00:00:00 2001
From: Octoturge <iwo@octoturge.com>
Date: Sun, 23 Aug 2026 16:20:13 +0200
Subject: [PATCH] Rename GITEA_ROTATION_TOKEN secret to ROTATION_PAT (GITEA_
 prefix is reserved)

---
 .gitea/workflows/rotate-coder-token.yml | 12 +++++++-----
 README.md                               |  8 +++++---
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/rotate-coder-token.yml b/.gitea/workflows/rotate-coder-token.yml
index 7ab7653..ba28a98 100644
--- a/.gitea/workflows/rotate-coder-token.yml
+++ b/.gitea/workflows/rotate-coder-token.yml
@@ -8,9 +8,11 @@ name: Rotate Coder API Token
 # it replaced.
 #
 # One-time bootstrap (see README "Auto-provisioning" section): a
-# GITEA_ROTATION_TOKEN secret holding a Gitea personal access token
-# (write:repository scope, no expiration) with permission to write this
-# repo's Actions secrets. Nothing else needs to touch this ever again.
+# ROTATION_PAT secret holding a Gitea personal access token (write:repository
+# scope, no expiration) with permission to write this repo's Actions secrets.
+# Not named GITEA_ROTATION_TOKEN because Gitea reserves the GITEA_ prefix for
+# its own automatic tokens/variables and rejects secrets with that prefix.
+# Nothing else needs to touch this ever again.
 
 on:
   schedule:
@@ -23,7 +25,7 @@ jobs:
     env:
       CODER_URL: ${{ secrets.CODER_URL }}
       CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
-      GITEA_ROTATION_TOKEN: ${{ secrets.GITEA_ROTATION_TOKEN }}
+      ROTATION_PAT: ${{ secrets.ROTATION_PAT }}
       GITEA_API_URL: ${{ github.server_url }}/api/v1
       GITEA_REPO_PATH: ${{ github.repository }}
     steps:
@@ -56,7 +58,7 @@ jobs:
           BODY="$(jq -n --arg data "$NEW_TOKEN" '{data:$data}')"
           HTTP_STATUS="$(curl -s -o /tmp/put-secret.out -w '%{http_code}' \
             -X PUT \
-            -H "Authorization: token ${GITEA_ROTATION_TOKEN}" \
+            -H "Authorization: token ${ROTATION_PAT}" \
             -H "Content-Type: application/json" \
             -d "$BODY" \
             "${GITEA_API_URL}/repos/${GITEA_REPO_PATH}/actions/secrets/CODER_SESSION_TOKEN")"
diff --git a/README.md b/README.md
index 78dd058..6c04b87 100644
--- a/README.md
+++ b/README.md
@@ -201,12 +201,14 @@ workflow write to its own repo's secrets):
 1. Create a Gitea personal access token with **write:repository** scope and
    **no expiration** (Settings -> Applications -> Generate New Token). This
    one doesn't rotate itself, so give it a long life up front.
-2. Add it as a repo/org Actions secret named `GITEA_ROTATION_TOKEN` (same
+2. Add it as a repo/org Actions secret named `ROTATION_PAT` (same
    Settings -> Actions -> Secrets page as above - if that tab is missing,
    see the nav-link workaround / API fallback in the "Auto-provisioning"
    section above, same `curl -X PUT .../actions/secrets/<name>` pattern,
-   just with `GITEA_ROTATION_TOKEN` as the secret name and the PAT itself as
-   the value).
+   just with `ROTATION_PAT` as the secret name and the PAT itself as the
+   value). Not named `GITEA_ROTATION_TOKEN` - Gitea reserves the `GITEA_`
+   prefix for its own automatic tokens/variables and rejects secrets with
+   that prefix (`Error: invalid variable or secret name`).
 
 After that, `CODER_SESSION_TOKEN` never needs manual attention again - you
 can also trigger a rotation on demand from Gitea's Actions tab