Port: Time runs on Gitea (teahub.xyz) (#47)

.github/workflows/ci.yml

@@ -4,7 +4,7 @@ on:
   pull_request:
   push:
     branches: [main]
-  workflow_dispatch:   # Time runs CI on a worker's PR branch by hand (pull_request skips token pushes)
+  workflow_dispatch:   # Time can run CI on a worker's PR branch by hand
 permissions:
   contents: read
 jobs:

.github/workflows/heartbeat.yml

@@ -11,21 +11,16 @@ on:
     types: [submitted]
   issue_comment:
     types: [created]
-permissions:
-  contents: write      # squash-merge approved, green PRs
-  issues: write
-  pull-requests: write
-  checks: read
-  statuses: write     # a Venice worker's test run is recorded as the PR's check
+# (GitHub-style `permissions:` are ignored by Gitea; the Actions token has write access to this repo)
 concurrency:
   group: heartbeat
   cancel-in-progress: false
 jobs:
   tick:
-    # issues: only `ready`/`spec` labels. comments: only on PRs, only a reviewer verdict (Approve/Object).
+    # issues: only `ready`/`spec` labels. comments: only on PRs, only a reviewer verdict (Approve/Object), never Time's own.
     if: >-
       (github.event_name != 'issues' || contains(fromJSON('["ready","spec"]'), github.event.label.name)) &&
-      (github.event_name != 'issue_comment' || (github.event.issue.pull_request &&
+      (github.event_name != 'issue_comment' || (github.event.issue.pull_request && github.event.comment.user.login != 'gitea-actions' &&
         (startsWith(github.event.comment.body, '**Approve') || startsWith(github.event.comment.body, 'Approve') ||
          startsWith(github.event.comment.body, '**Object') || startsWith(github.event.comment.body, 'Object'))))
     runs-on: ubuntu-latest

.github/workflows/mention.yml

@@ -14,12 +14,12 @@ concurrency:
   cancel-in-progress: false
 jobs:
   reply:
-    # cheap filter before a runner spins up: a mention, not from a bot, and only from people with a say in this repo
-    # (public repo: strangers can comment, but must not be able to spend the seats' model credits)
+    # cheap filter before a runner spins up: a mention, and not Time's own comment (Gitea fires events for the Actions
+    # token's writes). Who may spend the seats' credits is checked in time.py (collaborator permission); Gitea has no
+    # author_association in the event.
     if: >-
       contains(github.event.comment.body || github.event.issue.body, '@') &&
-      (github.event.comment.user.type || github.event.issue.user.type) != 'Bot' &&
-      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association || github.event.issue.author_association)
+      (github.event.comment.user.login || github.event.issue.user.login) != 'gitea-actions'
     runs-on: ubuntu-latest
     timeout-minutes: 8
     steps: