Git updates: access token for a private repository

Git updates (Baza Helper > Git updates, a Pro tool) installs a theme from a Git repository. A public repository needs no token. A private one needs a token that lets the site read it, and only read it.

Before you start

• Public repository: leave Access token (private repository) empty. If a token is saved, press Remove the saved token.
• Private repository: make a token that can read this one repository and nothing else, so it can do no harm if it ever leaks.
• The token is saved encrypted and is never shown again. Copy it when the host shows it.

GitHub: a fine-grained token

1. Open github.com/settings/personal-access-tokens/new (Settings, Developer settings, Personal access tokens, Fine-grained tokens).
2. Type a name and choose an expiry date.
3. Resource owner: your account. If the repository belongs to an organization, choose the organization. The organization may have to approve the token before it works.
4. Repository access: choose Only select repositories and select the repository with your theme.
5. Repository permissions: set Contents to Read-only. GitHub adds Metadata: Read-only by itself. Leave everything else at No access.
6. Press Generate token, copy the token and paste it into Access token (private repository).
7. Press Save changes, then Check now. The buttons use the saved settings.

GitLab

Create a personal or project access token with the scope read_repository. A project token needs the role Reporter or higher. Paste it into the same field.

Bitbucket

Open the repository, then Repository settings, Access tokens, and create a repository access token with read permission. Paste it into the same field.

What a sync replaces

• Update now replaces the whole theme folder with the content of the repository archive. A file that is on the site but not in the archive is gone afterwards.
• Baza Helper does not read .gitignore. What is listed there, for example vendor/ or node_modules/, is not in the repository, so it disappears from the site after the sync. Commit the folders your theme needs at run time, or build them before you push.
• GitHub leaves out of its archive what .gitattributes marks with export-ignore, so those files disappear from the site too.
• Before every update a zip of the current theme is saved. The newest copies are kept (Saved copies to keep, 3 by default), and Roll back installs the newest one.

Common errors

• The repository rejected the saved token (401 or 403): the token has expired, it was made for another owner or another repository, an organization has not approved it, Contents is not set to Read-only, or the token was pasted with a space.
• The repository was not found (404), also when the archive is downloaded: the address is wrong, or the token cannot read the contents of this private repository. Make the token again with the rights above. For an organization, choose the organization as Resource owner.
• The repository asks for a login and no token is saved: it is private. Add a token and save.
• The repository does not contain a theme there: there is no style.css with a Theme Name at that place. Check Theme folder inside the repository.
• The repository is public, but a token is saved: a wrong or expired token can make the host refuse a repository that anyone may read. Remove the token: a public repository does not need one.