gitea-admin/gh-christianlouis-inboxconverge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #95 from christianlouis/copilot/update-preprod-k8s-manifest

Browse Source 
ci: validate GH_PAT repo access before k8s manifest checkout
This commit is contained in:
Christian Krakau-Louis
2026-03-27 15:35:53 +01:00
committed by GitHub
parent fd7f797d12 67f5f0b18e
commit a2ddaed54c
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+12 -3
View File
@@ -14,6 +14,7 @@ on:
env: env:
GHCR_REGISTRY: ghcr.io GHCR_REGISTRY: ghcr.io
PRIVATE_REGISTRY: registry.cklnet.com PRIVATE_REGISTRY: registry.cklnet.com
K8S_STATE_REPO: christianlouis/k8s-cluster-state
jobs: jobs:
# ── Phase 1: Lint ────────────────────────────────────────────────────── # ── Phase 1: Lint ──────────────────────────────────────────────────────
@@ -243,7 +244,7 @@ jobs:
echo "frontend_image=ghcr.io/${{ github.repository_owner }}/inboxconverge/frontend:sha-${SHORT_SHA}" >> "$GITHUB_OUTPUT" echo "frontend_image=ghcr.io/${{ github.repository_owner }}/inboxconverge/frontend:sha-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT" echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
- name: Check if GH_PAT is configured - name: Check if GH_PAT is configured and has repo access
id: pat-check id: pat-check
env: env:
GH_PAT: ${{ secrets.GH_PAT }} GH_PAT: ${{ secrets.GH_PAT }}
@@ -252,14 +253,22 @@ jobs:
echo "::warning::GH_PAT secret is not configured. Skipping k8s manifest update." echo "::warning::GH_PAT secret is not configured. Skipping k8s manifest update."
echo "available=false" >> "$GITHUB_OUTPUT" echo "available=false" >> "$GITHUB_OUTPUT"
else else
echo "available=true" >> "$GITHUB_OUTPUT" HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
--oauth2-bearer "$GH_PAT" \
"https://api.github.com/repos/${{ env.K8S_STATE_REPO }}")
if [ "$HTTP_CODE" = "200" ]; then
echo "available=true" >> "$GITHUB_OUTPUT"
else
echo "::warning::GH_PAT does not have access to ${{ env.K8S_STATE_REPO }} (HTTP $HTTP_CODE). Skipping k8s manifest update."
echo "available=false" >> "$GITHUB_OUTPUT"
fi
fi fi
- name: Checkout k8s-cluster-state - name: Checkout k8s-cluster-state
if: steps.pat-check.outputs.available == 'true' if: steps.pat-check.outputs.available == 'true'
uses: actions/checkout@v4 uses: actions/checkout@v4
with: with:
repository: christianlouis/k8s-cluster-state repository: ${{ env.K8S_STATE_REPO }}
token: ${{ secrets.GH_PAT }} token: ${{ secrets.GH_PAT }}
path: k8s-cluster-state path: k8s-cluster-state
ref: main ref: main
CHANGELOG.md
+1
View File
@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased] ## [Unreleased]
### Fixed ### Fixed
- **CI `update-k8s-manifest` job**: Enhanced the PAT validation step to verify the token actually has read access to the `k8s-cluster-state` repository (via a GitHub API probe) before attempting checkout, preventing a 403 "Write access to repository not granted" failure when the PAT exists but lacks the necessary repository access.
- **CI `update-k8s-manifest` job**: Added a `Check if GH_PAT is configured` step that emits a warning and skips the GitOps steps when the `GH_PAT` secret is absent or empty, preventing a 403 "Write access to repository not granted" failure that blocked the pipeline when the secret was not set. - **CI `update-k8s-manifest` job**: Added a `Check if GH_PAT is configured` step that emits a warning and skips the GitOps steps when the `GH_PAT` secret is absent or empty, preventing a 403 "Write access to repository not granted" failure that blocked the pipeline when the secret was not set.
- **CI `update-k8s-manifest` job**: Fixed checkout of `k8s-cluster-state` repo by adding `ref: main` to the `actions/checkout` step, preventing a "Not Found" 404 error caused by the action's API call to determine the default branch. Also corrected the image tag format from `main-<sha>` to `sha-<sha>` to match the tags actually generated by `docker/metadata-action@v5` with `type=sha`. - **CI `update-k8s-manifest` job**: Fixed checkout of `k8s-cluster-state` repo by adding `ref: main` to the `actions/checkout` step, preventing a "Not Found" 404 error caused by the action's API call to determine the default branch. Also corrected the image tag format from `main-<sha>` to `sha-<sha>` to match the tags actually generated by `docker/metadata-action@v5` with `type=sha`.
- **`ProgrammingError` on `notification_configs`**: Added Alembic migration `0001` that runs `ALTER TABLE notification_configs ADD COLUMN IF NOT EXISTS` for the `name` and `apprise_url` columns introduced by the Apprise PR. SQLAlchemy's `create_all` does not ALTER existing tables, so existing deployments were missing these columns and crashing at runtime. The migration is idempotent (`IF NOT EXISTS`) so it is safe for fresh installs too. `app/main.py` lifespan now runs `alembic upgrade head` after `create_all`. - **`ProgrammingError` on `notification_configs`**: Added Alembic migration `0001` that runs `ALTER TABLE notification_configs ADD COLUMN IF NOT EXISTS` for the `name` and `apprise_url` columns introduced by the Apprise PR. SQLAlchemy's `create_all` does not ALTER existing tables, so existing deployments were missing these columns and crashing at runtime. The migration is idempotent (`IF NOT EXISTS`) so it is safe for fresh installs too. `app/main.py` lifespan now runs `alembic upgrade head` after `create_all`.