Merge pull request #93 from christianlouis/copilot/fix-git-fetch-error

fix(ci): guard update-k8s-manifest job against missing GH_PAT secret

.github/workflows/ci.yml

@@ -243,7 +243,20 @@ jobs:
           echo "frontend_image=ghcr.io/${{ github.repository_owner }}/inboxconverge/frontend:sha-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
           echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
 
+      - name: Check if GH_PAT is configured
+        id: pat-check
+        env:
+          GH_PAT: ${{ secrets.GH_PAT }}
+        run: |
+          if [ -z "$GH_PAT" ]; then
+            echo "::warning::GH_PAT secret is not configured. Skipping k8s manifest update."
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Checkout k8s-cluster-state
+        if: steps.pat-check.outputs.available == 'true'
         uses: actions/checkout@v4
         with:
           repository: christianlouis/k8s-cluster-state
@@ -252,6 +265,7 @@ jobs:
           ref: main
 
       - name: Update backend image tag in preprod manifest
+        if: steps.pat-check.outputs.available == 'true'
         uses: mikefarah/yq@v4.44.6
         env:
           IMAGE: ${{ steps.tag.outputs.backend_image }}
@@ -261,6 +275,7 @@ jobs:
               k8s-cluster-state/apps/gmail-puller/preprod/gmail-puller-stack.yaml
 
       - name: Update frontend image tag in preprod manifest
+        if: steps.pat-check.outputs.available == 'true'
         uses: mikefarah/yq@v4.44.6
         env:
           IMAGE: ${{ steps.tag.outputs.frontend_image }}
@@ -270,6 +285,7 @@ jobs:
               k8s-cluster-state/apps/gmail-puller/preprod/gmail-puller-stack.yaml
 
       - name: Commit and push manifest update
+        if: steps.pat-check.outputs.available == 'true'
         run: |
           cd k8s-cluster-state
           git config user.name "github-actions[bot]"

CHANGELOG.md

@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- **CI `update-k8s-manifest` job**: Added a `Check if GH_PAT is configured` step that emits a warning and skips the GitOps steps when the `GH_PAT` secret is absent or empty, preventing a 403 "Write access to repository not granted" failure that blocked the pipeline when the secret was not set.
 - **CI `update-k8s-manifest` job**: Fixed checkout of `k8s-cluster-state` repo by adding `ref: main` to the `actions/checkout` step, preventing a "Not Found" 404 error caused by the action's API call to determine the default branch. Also corrected the image tag format from `main-<sha>` to `sha-<sha>` to match the tags actually generated by `docker/metadata-action@v5` with `type=sha`.
 - **`ProgrammingError` on `notification_configs`**: Added Alembic migration `0001` that runs `ALTER TABLE notification_configs ADD COLUMN IF NOT EXISTS` for the `name` and `apprise_url` columns introduced by the Apprise PR. SQLAlchemy's `create_all` does not ALTER existing tables, so existing deployments were missing these columns and crashing at runtime. The migration is idempotent (`IF NOT EXISTS`) so it is safe for fresh installs too. `app/main.py` lifespan now runs `alembic upgrade head` after `create_all`.
 - **`/logs` page 404**: Created missing Next.js page at `src/app/logs/page.tsx`. The user-facing "Logs" sidebar link was pointing to `/logs` but no page existed. The new page lists all processing runs with expandable per-email log details and pagination.

docs/TODO.md

@@ -12,6 +12,7 @@ Comprehensive task breakdown for repository improvements and production readines
 - [x] Added Semantic Release workflow (`release.yml`) for automatic versioning and GitHub Releases.
 - [x] Added `pyproject.toml` with `[tool.semantic_release]` configuration.
 - [x] Added GitOps auto-deployment step in `ci.yml` to update preprod k8s manifest in `k8s-cluster-state` repo.
+- [x] Fixed GitOps `update-k8s-manifest` job: added PAT availability check to skip gracefully when `GH_PAT` secret is not configured, fixing 403 "Write access to repository not granted" pipeline failure.
 
 ## 🔴 Critical - Security (In Progress)