From 877d78e68e679b2c488bd2b474e34bba0060426e Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Wed, 8 Jul 2026 20:05:39 +0200
Subject: [PATCH] fix(cicd): render agentrun PaC token per lane

---
 scripts/src/agentrun-manifests.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/src/agentrun-manifests.ts b/scripts/src/agentrun-manifests.ts
index 09f71db0..fab3a575 100644
--- a/scripts/src/agentrun-manifests.ts
+++ b/scripts/src/agentrun-manifests.ts
@@ -281,7 +281,7 @@ function agentRunBuildPublishTask(spec: AgentRunLaneSpec): Record<string, unknow
           name: "publish-gitops",
           image: "$(params.tools-image)",
           env: [
-            { name: "GITEA_TOKEN", valueFrom: { secretKeyRef: { name: "pac-gitea-agentrun-jd01-v02", key: "token", optional: true } } },
+            { name: "GITEA_TOKEN", valueFrom: { secretKeyRef: { name: agentRunPacGiteaSecretName(spec), key: "token", optional: true } } },
           ],
           script: agentRunTektonGitopsPublishScript(spec),
         },
@@ -773,6 +773,12 @@ function agentRunLabels(spec: AgentRunLaneSpec): Record<string, string> {
   };
 }
 
+function agentRunPacGiteaSecretName(spec: AgentRunLaneSpec): string {
+  const consumerId = spec.ci.pipelineRunPrefix.replace(/-ci$/u, "");
+  if (consumerId === spec.ci.pipelineRunPrefix) throw new Error(`config/agentrun.yaml controlPlane.lanes.${spec.lane}.ci.pipelineRunPrefix must end with -ci`);
+  return `pac-gitea-${consumerId}`;
+}
+
 function yaml(value: unknown): string {
   return `${Bun.YAML.stringify(value).trim()}\n`;
 }