Files

T

codex-bot 5ba2f24a6e Vela quick-app dev skill + knowledge base (S4 41mm)

- SKILL.md: toolchain, project structure, round-screen layout, TDD harness,
  input/crown findings, per-app notes
- references: gitea-publish workflow, S4 session log, historical nyan-watch notes
- README: overview + key facts

2026-09-09 15:16:30 +01:00

2.2 KiB

Raw Permalink Blame History

Publishing Vela apps to the user's Gitea

Self-hosted Gitea: https://gitea.oimcloud.myaddr.tools/ — account codex-bot (id 55, admin), email codex-bot@bots.com. Auth: git config --global credential.helper store + ~/.git-credentials (chmod 600) holding https://codex-bot:<token>@gitea.oimcloud.myaddr.tools. git identity = codex-bot / codex-bot@bots.com. Token is a 40-char hex (Gitea access token).

Create a repo (Gitea API)

TOKEN=<40-char-hex>  BASE=https://gitea.oimcloud.myaddr.tools
curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
  -d '{"name":"vela-snake","description":"...","private":false,"auto_init":false}' \
  "$BASE/api/v1/user/repos"

Push source

git init -b main; git add -A; git commit -m "..."
git remote add origin "$BASE/codex-bot/<repo>.git"; git push -u origin main

Attach the .rpk as a tagged release asset (two API calls)

# 1) create release -> returns JSON with an 'id'
curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
  -d '{"tag_name":"v0.3","target_commitish":"main","name":"SNAKE 0.3","body":"..."}' \
  "$BASE/api/v1/repos/codex-bot/<repo>/releases"
# 2) upload the binary (multipart)
curl -X POST -H "Authorization: token $TOKEN" -F "attachment=@dist/foo.rpk" \
  "$BASE/api/v1/repos/codex-bot/<repo>/releases/<id>/assets?name=foo.rpk"

Open an issue

curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
  -d '{"title":"...","body":"..."}' "$BASE/api/v1/repos/codex-bot/<repo>/issues"

Pitfalls

node_modules is a symlink → /tmp/hw/node_modules. .gitignore must say node_modules (NO trailing slash) — a trailing slash matches directories only, so the symlink was committed until fixed with git rm --cached node_modules.
sign/*.pem holds the signing key + cert — keep gitignored; NEVER commit private.pem.
dist/ and build/ are gitignored; the installable .rpk is delivered via a release asset, not committed to git.
Verify nothing secret leaked: git ls-files | grep -E 'sign|dist|node_modules|\.pem|\.rpk' should be empty (the node_modules symlink must also be excluded).

2.2 KiB Raw Permalink Blame History