All checks were successful
continuous-integration/drone/push Build is passing
Found during the e2e: when the bot already granted the shared Drone OAuth app, Gitea 302s straight to the code callback (no consent form), so the consent-form parse yielded empty _csrf/state and set -e aborted. Now: if authorize returns a Location, use it directly; else POST the consent form. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>