Merge pull request #95 from christianlouis/copilot/update-preprod-k8s-manifest

ci: validate GH_PAT repo access before k8s manifest checkout

.github/workflows/ci.yml

@@ -14,6 +14,7 @@ on:
 env:
   GHCR_REGISTRY: ghcr.io
   PRIVATE_REGISTRY: registry.cklnet.com
+  K8S_STATE_REPO: christianlouis/k8s-cluster-state
 
 jobs:
   # ── Phase 1: Lint ──────────────────────────────────────────────────────
@@ -243,7 +244,7 @@ jobs:
           echo "frontend_image=ghcr.io/${{ github.repository_owner }}/inboxconverge/frontend:sha-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
           echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
 
-      - name: Check if GH_PAT is configured
+      - name: Check if GH_PAT is configured and has repo access
         id: pat-check
         env:
           GH_PAT: ${{ secrets.GH_PAT }}
@@ -252,14 +253,22 @@ jobs:
             echo "::warning::GH_PAT secret is not configured. Skipping k8s manifest update."
             echo "available=false" >> "$GITHUB_OUTPUT"
           else
-            echo "available=true" >> "$GITHUB_OUTPUT"
+            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+              --oauth2-bearer "$GH_PAT" \
+              "https://api.github.com/repos/${{ env.K8S_STATE_REPO }}")
+            if [ "$HTTP_CODE" = "200" ]; then
+              echo "available=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "::warning::GH_PAT does not have access to ${{ env.K8S_STATE_REPO }} (HTTP $HTTP_CODE). Skipping k8s manifest update."
+              echo "available=false" >> "$GITHUB_OUTPUT"
+            fi
           fi
 
       - name: Checkout k8s-cluster-state
         if: steps.pat-check.outputs.available == 'true'
         uses: actions/checkout@v4
         with:
-          repository: christianlouis/k8s-cluster-state
+          repository: ${{ env.K8S_STATE_REPO }}
           token: ${{ secrets.GH_PAT }}
           path: k8s-cluster-state
           ref: main

CHANGELOG.md

@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- **CI `update-k8s-manifest` job**: Enhanced the PAT validation step to verify the token actually has read access to the `k8s-cluster-state` repository (via a GitHub API probe) before attempting checkout, preventing a 403 "Write access to repository not granted" failure when the PAT exists but lacks the necessary repository access.
 - **CI `update-k8s-manifest` job**: Added a `Check if GH_PAT is configured` step that emits a warning and skips the GitOps steps when the `GH_PAT` secret is absent or empty, preventing a 403 "Write access to repository not granted" failure that blocked the pipeline when the secret was not set.
 - **CI `update-k8s-manifest` job**: Fixed checkout of `k8s-cluster-state` repo by adding `ref: main` to the `actions/checkout` step, preventing a "Not Found" 404 error caused by the action's API call to determine the default branch. Also corrected the image tag format from `main-<sha>` to `sha-<sha>` to match the tags actually generated by `docker/metadata-action@v5` with `type=sha`.
 - **`ProgrammingError` on `notification_configs`**: Added Alembic migration `0001` that runs `ALTER TABLE notification_configs ADD COLUMN IF NOT EXISTS` for the `name` and `apprise_url` columns introduced by the Apprise PR. SQLAlchemy's `create_all` does not ALTER existing tables, so existing deployments were missing these columns and crashing at runtime. The migration is idempotent (`IF NOT EXISTS`) so it is safe for fresh installs too. `app/main.py` lifespan now runs `alembic upgrade head` after `create_all`.