From 420507da7754a30a31f2c146c831ecf60f38bd0d Mon Sep 17 00:00:00 2001 From: fargo Date: Wed, 19 Aug 2026 22:51:35 +0000 Subject: [PATCH] fix(#1323): remove legacy credential read and force-merge recipe from mosaic-gitea (#1325) --- .../framework/skills/mosaic-gitea/SKILL.md | 21 ++++++------------- 1 file changed, 6 insertions(+), 15 deletions(-) diff --git a/packages/mosaic/framework/skills/mosaic-gitea/SKILL.md b/packages/mosaic/framework/skills/mosaic-gitea/SKILL.md index fd1a8818..9ae65e62 100644 --- a/packages/mosaic/framework/skills/mosaic-gitea/SKILL.md +++ b/packages/mosaic/framework/skills/mosaic-gitea/SKILL.md @@ -11,13 +11,8 @@ Git operations via Mosaic wrapper scripts. Platform-aware (Gitea or GitHub). Scripts auto-detect platform from git remote. Run from inside the repo directory. -For force-merge (branch protection bypass): - -```bash -GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2) -``` - -Or use the credentials loader: +Credentials come from the framework credentials loader (never from a shared env +file): ```bash source ~/.config/mosaic/tools/_lib/credentials.sh @@ -86,14 +81,10 @@ cd ~/src/ ~/.config/mosaic/tools/git/pr-merge.sh -n -d ``` -**Force-merge bypassing branch protection:** - -```bash -GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2) -curl -X POST "https://git.mosaicstack.dev/api/v1/repos///pulls//merge" \ - -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \ - -d '{"Do":"squash","force_merge":true}' -``` +Branch protection is a gate, not an obstacle: if it blocks a merge, fix the cause — +a failing check, a moved head, or a missing review. Never bypass it with a raw +API call, a shared credential, or `force_merge`. Exceptional cases go to the +operator or the coordinating seat, still merged through the wrapper. ## Notes