ci(update-audit): post issues with gitea_token (has write:issue) #68

2026-06-27T07:37:38Z

k.renner commented

2026-06-27 07:37:38 +00:00

security_bot_token is scoped for code/PRs only — the post step's issue POST returned HTTP 403 token does not have ... write:issue, so the audit ran green but silently created no issue (the failure #35 surfaced).

Change

Point GITEA_TOKEN at the existing gitea_token secret instead of security_bot_token. gitea_token is the broader machine account already used by build-caddy (release assets) and build-ci-images (registry pushes), so it's the most likely existing secret to also carry write:issue — and it needs no new token provisioned.

Trade-off

Audit issues become attributed to gitea_token's owner rather than the security bot.

Validation

Tested via a manual run on this branch (pipeline #1032) before merge — result noted in a comment.

🤖 Generated with Claude Code

security_bot_token is scoped for code/PRs only — the post step's issue POST returned HTTP 403 `token does not have ... write:issue`, so the audit ran green but silently created no issue (the failure #35 surfaced). ## Change Point `GITEA_TOKEN` at the existing **gitea_token** secret instead of `security_bot_token`. gitea_token is the broader machine account already used by build-caddy (release assets) and build-ci-images (registry pushes), so it's the most likely existing secret to also carry `write:issue` — and it needs no new token provisioned. ## Trade-off Audit issues become attributed to gitea_token's owner rather than the security bot. ## Validation Tested via a manual run on this branch (pipeline #1032) before merge — result noted in a comment. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-06-27 07:37:39 +00:00

ci(update-audit): post issues with gitea_token (has write:issue)

ci/woodpecker/manual/update-audit Pipeline was successful

Details

dd32b5d917

security_bot_token is scoped for code/PRs only; the issue POST in the
post step returned HTTP 403 'token does not have ... write:issue', so the
audit ran green but silently created no issue. Switch GITEA_TOKEN to the
gitea_token secret — the broader machine account already used by
build-caddy and build-ci-images for release-asset and registry writes —
which is the most likely existing secret to also hold write:issue.

No new token to provision; audit issues become attributed to gitea_token's
owner instead of the security bot.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner commented

2026-06-27 07:46:36 +00:00

✅ Validated on branch — manual run #1032 (this branch's pipeline, with gitea_token) went green. The post step logged Creating new audit issue → number: 69 with no 403, confirming gitea_token carries write:issue.

Live result: issue #69, authored by gitea_admin (the gitea_token owner — the attribution trade-off noted above).

Once merged, the weekly cron run will find #69 by title and update it rather than create new issues. Ready for review/merge.

✅ **Validated on branch** — manual run [#1032](https://ci.renner.uno/repos/1/pipeline/1032) (this branch's pipeline, with `gitea_token`) went green. The post step logged `Creating new audit issue → number: 69` with no 403, confirming `gitea_token` carries `write:issue`. Live result: [issue #69](https://gitea.renner.uno/gitea_admin/homelab/issues/69), authored by **gitea_admin** (the `gitea_token` owner — the attribution trade-off noted above). Once merged, the weekly cron run will *find #69 by title and update it* rather than create new issues. Ready for review/merge.

k.renner merged commit 89098710b9 into master

2026-06-27 07:48:19 +00:00

k.renner referenced this issue from a commit

2026-06-27 07:48:19 +00:00

Merge pull request 'ci(update-audit): post issues with gitea_token (has write:issue)' (#68) from update-audit-use-gitea-token into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#68