konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 3 Packages Projects Releases 1 Wiki Activity

fix(review-bot): mint the review-bot PAT with read:issue #1506

Closed
hermes-bot wants to merge 1 commits from alert-fix/issue-1505 into main
pull from: alert-fix/issue-1505
merge into: :main
Conversation 2 Commits 1 Files Changed 3
+103 -1
1 Commits
Author SHA1 Message Date
hermes-bot a4c1f31557 fix(review-bot): mint the review-bot PAT with read:issue
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details 
Since 9ec31f07 (PR #1503) review-bot's sweep lists the PRs that request its
review via GET /repos/issues/search?review_requested=true. Gitea requires
read:issue for that endpoint, and the rotator mints the review-bot PAT with
write:repository only, so every 5-minute sweep fails with HTTP 403 and
requested reviews are picked up only by the webhook.

- review-bot-secret-rotate: GITEA_SCOPES = write:repository,read:issue.
- One-shot Job review-bot-rotate-read-issue runs the CronJob's rotate-mint and
  sync-woodpecker steps once, so the new token is minted on merge instead of
  at the next quarterly run (2027-01-01). ESO (refresh 1h) picks it up and
  Reloader restarts review-bot. Remove the Job in a follow-up once it ran.

Closes #1505
 2026-10-27 23:25:12 +00:00