.env.example

# GitHub Personal Access Tokens used only by local integration/e2e tests
# (pnpm test:integration / pnpm test:e2e) — never by the app itself. All four
# are optional and independent: set any subset to run the tests against that
# token; set none and the tests skip cleanly.
#
# Named GH_ rather than GITHUB_ because GitHub Actions rejects any repository
# secret whose name starts with GITHUB_ (that prefix is reserved for its own
# built-in variables) — confirmed the hard way via `gh secret set`.
#
# Copy this file to .env (already gitignored) and fill in real values.

# --- Public access -----------------------------------------------------
# Scope each minimally — these only resolve the token's own identity and
# read github.com/octocat/Hello-World, a public repo, neither of which needs
# elevated access. Never grant write access or access to private resources
# for a token meant only for public-access test runs.

# Classic token: no scopes are needed for these checks (self-identity and
# public data don't require any) — see the app's own GitHubPanel for the
# broader scopes (repo, read:org, read:project) a *real* graphle session
# needs beyond just running these tests.
GH_TEST_PAT_CLASSIC=

# Fine-grained token: the default "Public Repositories (read-only)" access
# every fine-grained token has, regardless of its repository selection, is
# enough.
GH_TEST_PAT_FINE_GRAINED=

# --- Private access ------------------------------------------------------
# These read two dedicated, otherwise-unused fixture repos created solely for
# this purpose (Mearman/graphle-test-private, ExaDev/graphle-test-private) —
# not any real project data. Deliberately kept as SEPARATE tokens from the
# public ones above, rather than widening those, so the public-access tokens
# stay minimally scoped.

# Classic token: needs the `repo` scope — classic PATs have no finer-grained
# private-read-only option, so this token can read (and write) every private
# repo the account can access. Keep it dedicated to test use only.
GH_TEST_PAT_CLASSIC_PRIVATE=

# Fine-grained token: resource owner ExaDev, "All repositories", with the
# "Contents: Read-only" permission explicitly added. Unlike public repos
# (unconditionally readable by any fine-grained token regardless of granted
# permissions — confirmed via the token creation page's own note), reading a
# private repo needs that explicit Contents permission; the auto-included
# Metadata-only default that's enough for public access is not sufficient —
# confirmed the hard way, `getRepo` against a private repo returned notFound
# with only Metadata granted. "Only select repositories" (scoped to just
# ExaDev/graphle-test-private) was tried first and repeatedly failed the
# same way even though the UI showed the repository as selected right up to
# submission — the selection never actually attached to the generated
# token, a GitHub UI issue, not a config mistake; "All repositories" sidesteps
# it. A fine-grained token can only target one resource owner, so this
# covers the org-private case; the classic token above (whose `repo` scope
# isn't owner-restricted) covers the personal-private case
# (Mearman/graphle-test-private) as well as this same org repo.
GH_TEST_PAT_FINE_GRAINED_PRIVATE=