From c2055e85ebc61570f2a14283566384446affc541 Mon Sep 17 00:00:00 2001
From: teahubxyz <teahubxyz@users.noreply.teahub.xyz>
Date: Wed, 14 Oct 2026 14:02:51 -0700
Subject: [PATCH] time: every write but comments and statuses goes out as the
 time bot

Gitea 1.24 also refuses the Actions identity label edits (removing a label is a 500), which crashed
promote_next and stalled the queue. gh() now uses TIME_TOKEN for every write except comments (Time's
beats are gitea-actions' comments) and commit statuses; the time user never counts as trusted and
mention replies ignore it; astra.yml gets TIME_TOKEN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017fTCFiw6ohysUDcWoPsTys
---
 .github/time/test_time.py     | 17 +++++++++++++++++
 .github/time/time.py          | 17 +++++++++++------
 .github/time/venture.py       |  2 +-
 .github/workflows/astra.yml   |  1 +
 .github/workflows/mention.yml |  3 ++-
 5 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/.github/time/test_time.py b/.github/time/test_time.py
index 6a7b0ec..6419f78 100644
--- a/.github/time/test_time.py
+++ b/.github/time/test_time.py
@@ -421,6 +421,23 @@ assert real_git_commit("time/card-9", {"src/a.py": None}, "rm") and "src/a.py" n
 tm.SERVER, tm.REPO, tm.default_branch = _saved
 print("ALL OK 53")
 
+# writes go out as Time's own user, except comments and statuses (Gitea refuses the Actions identity the rest)
+_seen, _real_http, _gt = [], tm.http, os.environ.get("GITHUB_TOKEN")
+tm.http = lambda method, url, token, body=None, timeout=0: _seen.append(token) or {}
+os.environ["TIME_TOKEN"], os.environ["GITHUB_TOKEN"] = "tt", "gt"
+for _m, _p in [("DELETE", "/repos/o/r/issues/1/labels/3"), ("POST", "/repos/o/r/issues/1/labels"), ("POST", "/repos/o/r/issues"),
+               ("PATCH", "/repos/o/r/issues/1"), ("POST", "/repos/o/r/pulls"), ("POST", "/repos/o/r/issues/1/comments"),
+               ("PATCH", "/repos/o/r/issues/comments/9"), ("POST", "/repos/o/r/statuses/abc"), ("GET", "/repos/o/r/labels?limit=100")]:
+    tm.gh(_m, _p, {})
+assert _seen == ["tt"] * 5 + ["gt"] * 4, _seen
+os.environ.pop("TIME_TOKEN"); _seen.clear(); tm.gh("DELETE", "/repos/o/r/issues/1/labels/3")
+assert _seen == ["gt"], "no TIME_TOKEN: the Actions token, as on GitHub"
+assert not tm.trusted("time") and not tm.trusted(tm.TIME_BOT), "Time never vouches for itself"
+tm.http = _real_http
+if _gt is None: os.environ.pop("GITHUB_TOKEN", None)
+else: os.environ["GITHUB_TOKEN"] = _gt
+print("ALL OK 54")
+
 # the worker itself (worker.js), against a fake D1, Workers AI and Pages
 import shutil as _sh, subprocess as _sp  # noqa: E402
 if _sh.which("node"):
diff --git a/.github/time/time.py b/.github/time/time.py
index c796b64..d6f05af 100644
--- a/.github/time/time.py
+++ b/.github/time/time.py
@@ -36,6 +36,7 @@ REPO = os.environ.get("GITHUB_REPOSITORY", "")
 SERVER = (os.environ.get("GITHUB_SERVER_URL") or "https://teahub.xyz").rstrip("/")
 GH = (os.environ.get("GITHUB_API_URL") or f"{SERVER}/api/v1").rstrip("/")
 TIME_BOT = os.environ.get("TIME_BOT") or "gitea-actions"  # the Actions token's user; Time's own comments
+TIME_USER = os.environ.get("TIME_USER") or "time"  # Time's own Gitea user (TIME_TOKEN): every write but comments and statuses
 VENICE = "https://api.venice.ai/api/v1"
 ANTHROPIC = "https://api.anthropic.com/v1"
 MARK = "<!-- time "
@@ -54,10 +55,14 @@ def http(method: str, url: str, token: str, body=None, timeout: float = 120.0):
         raise RuntimeError(f"{method} {url.split('?')[0]} -> {e.code}: {e.read().decode(errors='replace')[:200]}") from None
 
 
-def gh(method: str, path: str, body=None, *, as_time: bool = False):
-    """One API call. `as_time` uses TIME_TOKEN, the `time` bot's own token: Gitea lets the Actions identity comment and
-    label but not open or merge pull requests ("user must be a collaborator"), so those two go out as Time itself.
-    Without the secret the call falls back to the Actions token (GitHub, where it is enough)."""
+def gh(method: str, path: str, body=None, *, as_time: bool | None = None):
+    """One API call. Writes go out as Time's own user (`time`, TIME_TOKEN) by default: Gitea 1.24 refuses the Actions
+    identity any write whose service code re-checks the doer's permission (opening or merging a PR is a 403, removing
+    a label a 500). Comments and commit statuses stay with the Actions identity: those work, and Time's beats are the
+    comments `gitea-actions` wrote. `as_time` forces either way. Without the secret every call uses the Actions token
+    (GitHub, where it is enough)."""
+    if as_time is None:
+        as_time = method != "GET" and not re.search(r"/comments(/\d+)?$|/statuses/", path.split("?")[0])
     token = (os.environ.get("TIME_TOKEN") if as_time else None) or os.environ["GITHUB_TOKEN"]
     for attempt in range(5):
         try:
@@ -107,7 +112,7 @@ def trusted(login: str | None) -> bool:
     TIME_TRUSTED (comma-separated logins; org owners go here, since the Actions token cannot read org membership),
     and for repo collaborators. Strangers on a public repo can comment; none of that counts. Time's own user never
     counts as a reviewer."""
-    if not login or login == TIME_BOT:
+    if not login or login in (TIME_BOT, TIME_USER):  # Time never vouches for itself
         return False
     if login not in _trust:
         names = {n.strip() for n in (os.environ.get("TIME_TRUSTED") or "").split(",") if n.strip()}
@@ -358,7 +363,7 @@ def cmd_mention() -> int:
     issue = ev["issue"]
     src = ev.get("comment") or issue
     author = src["user"]
-    if author.get("login") == TIME_BOT or MARK in (src.get("body") or ""):
+    if author.get("login") in (TIME_BOT, TIME_USER) or MARK in (src.get("body") or ""):
         print("skip: Time's own comment")
         return 0
     if not trusted(author.get("login")):  # public repo: strangers can comment, but must not spend the seats' credits
diff --git a/.github/time/venture.py b/.github/time/venture.py
index 2e87e4d..3b29627 100644
--- a/.github/time/venture.py
+++ b/.github/time/venture.py
@@ -1038,7 +1038,7 @@ def form_fields(body: str) -> dict:
 
 def _person(user: dict | None) -> str | None:
     login = (user or {}).get("login", "")
-    if not login or user.get("type") == "Bot" or login.lower() == REPO.split("/")[0].lower():
+    if not login or user.get("type") == "Bot" or login.lower() in (REPO.split("/")[0].lower(), tm.TIME_USER):
         return None
     return login.lower()
 
diff --git a/.github/workflows/astra.yml b/.github/workflows/astra.yml
index 47d7caa..50a0fd4 100644
--- a/.github/workflows/astra.yml
+++ b/.github/workflows/astra.yml
@@ -24,6 +24,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          TIME_TOKEN: ${{ secrets.TIME_TOKEN }}   # repo secret: Astra's issues and labels go out as the `time` bot
           VENICE_API_KEY: ${{ secrets.VENICE_API_KEY }}
           TIME_ASTRA_SEAT: ${{ vars.TIME_ASTRA_SEAT }}
           TIME_ASTRA_MAX_READY: ${{ vars.TIME_ASTRA_MAX_READY }}
diff --git a/.github/workflows/mention.yml b/.github/workflows/mention.yml
index a496712..76ee7d7 100644
--- a/.github/workflows/mention.yml
+++ b/.github/workflows/mention.yml
@@ -19,7 +19,8 @@ jobs:
     # author_association in the event.
     if: >-
       contains(github.event.comment.body || github.event.issue.body, '@') &&
-      (github.event.comment.user.login || github.event.issue.user.login) != 'gitea-actions'
+      (github.event.comment.user.login || github.event.issue.user.login) != 'gitea-actions' &&
+      (github.event.comment.user.login || github.event.issue.user.login) != 'time'
     runs-on: ubuntu-latest
     timeout-minutes: 8
     steps: