ci(update-audit): surface Gitea API failures in the post step #35

2026-06-26T07:55:31Z

k.renner commented

2026-06-26 07:55:31 +00:00

Follow-up to the update-audit pipeline. The first smoke run (#986) went green but created no issue — the post step used jq | curl -sf | jq, so the pipe's exit status came from the trailing jq and a failed POST was swallowed.

Change

Rewrite the post step to capture each write's HTTP status via -w '%{http_code}', print it, and fail the step on any non-2xx (dumping the Gitea error body). Payloads are written to files instead of piped through the masking pipeline.

What it revealed

With the fix, run #987 failed loudly with the real cause:

POST .../issues -> HTTP 403
{"message":"token does not have at least one of required scope(s): [write:issue]"}

The agent itself works and produces the report; security_bot_token is scoped for code/PRs but lacks write:issue.

Required before this can post (separate, manual)

Grant write:issue to security_bot_token (Gitea PATs are immutable — recreate the bot token with its existing repo/PR scopes plus issue, then update the security_bot_token Woodpecker secret). No pipeline change needed once the token has the scope.

🤖 Generated with Claude Code

Follow-up to the update-audit pipeline. The first smoke run (#986) went **green but created no issue** — the post step used `jq | curl -sf | jq`, so the pipe's exit status came from the trailing `jq` and a failed POST was swallowed. ## Change Rewrite the post step to capture each write's HTTP status via `-w '%{http_code}'`, print it, and **fail the step on any non-2xx** (dumping the Gitea error body). Payloads are written to files instead of piped through the masking pipeline. ## What it revealed With the fix, run #987 failed loudly with the real cause: ``` POST .../issues -> HTTP 403 {"message":"token does not have at least one of required scope(s): [write:issue]"} ``` The agent itself works and produces the report; `security_bot_token` is scoped for code/PRs but lacks `write:issue`. ## Required before this can post (separate, manual) Grant `write:issue` to `security_bot_token` (Gitea PATs are immutable — recreate the bot token with its existing repo/PR scopes **plus** `issue`, then update the `security_bot_token` Woodpecker secret). No pipeline change needed once the token has the scope. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-06-26 07:55:31 +00:00

ci(update-audit): surface Gitea API failures in the post step

ci/woodpecker/manual/update-audit Pipeline failed

Details

7f383f3466

The first smoke run went green but created no issue: the post step used
`jq | curl -sf | jq`, so the pipe's exit status came from the trailing jq
and a failed POST was swallowed.

Rewrite the post step to capture each write's HTTP status explicitly via
`-w '%{http_code}'`, print it, and fail the step on any non-2xx (dumping the
Gitea error body). Payloads are written to files instead of piped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 1064b487c3 into master

2026-06-27 07:04:40 +00:00

k.renner referenced this issue from a commit

2026-06-27 07:04:41 +00:00

Merge pull request 'ci(update-audit): surface Gitea API failures in the post step' (#35) from update-audit-fix-issue-post into master

k.renner referenced this pull request

2026-06-27 07:37:38 +00:00

ci(update-audit): post issues with gitea_token (has write:issue) #68

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#35