.woodpecker/update-audit.yml

@@ -63,28 +63,44 @@ steps:
         # Post the report to a single persistent Gitea issue. Find the open
         # issue by its stable title; update its body and add a dated comment
         # if it exists, otherwise create it.
+        #
+        # Every write captures the HTTP status explicitly and fails the step
+        # on any non-2xx — a piped `... | curl -sf | jq` would mask a failed
+        # POST behind the trailing jq's exit code (the pipe's status is the
+        # LAST command), which is exactly how the first run went green while
+        # silently creating no issue.
+        set -eu
         TITLE="Infrastructure update audit"
-        BODY=$$(cat /tmp/update-audit.md)
         STAMP=$$(date -u +%Y-%m-%dT%H:%M:%SZ)
         API="https://gitea.renner.uno/api/v1/repos/gitea_admin/homelab"
+
+        # write <method> <url> <payload-file>  -> prints HTTP code, fails non-2xx
+        gitea_write() {
+          code=$$(curl -s -o /tmp/gitea-resp.json -w '%{http_code}' \
+            -X "$$1" -H "Authorization: token $$GITEA_TOKEN" \
+            -H "Content-Type: application/json" --data @"$$3" "$$2")
+          echo "$$1 $$2 -> HTTP $$code"
+          if [ "$$code" -lt 200 ] || [ "$$code" -ge 300 ]; then
+            echo "Gitea API error body:"; cat /tmp/gitea-resp.json; echo
+            return 1
+          fi
+        }
+
         ISSUE=$$(curl -sf -H "Authorization: token $$GITEA_TOKEN" \
           "$$API/issues?state=open&type=issues&limit=50" \
           | jq -r --arg t "$$TITLE" 'map(select(.title == $$t)) | .[0].number // empty')
+
         if [ -n "$$ISSUE" ]; then
           echo "Updating existing issue #$$ISSUE"
-          jq -n --arg body "$$BODY" '{body: $$body}' \
-            | curl -sf -X PATCH -H "Authorization: token $$GITEA_TOKEN" \
-                -H "Content-Type: application/json" --data @- \
-                "$$API/issues/$$ISSUE" | jq '{number, html_url}'
-          jq -n --arg body "🔄 Re-ran $$STAMP — report above refreshed." '{body: $$body}' \
-            | curl -sf -X POST -H "Authorization: token $$GITEA_TOKEN" \
-                -H "Content-Type: application/json" --data @- \
-                "$$API/issues/$$ISSUE/comments" > /dev/null
+          jq -n --arg body "$$(cat /tmp/update-audit.md)" '{body: $$body}' > /tmp/gitea-patch.json
+          gitea_write PATCH "$$API/issues/$$ISSUE" /tmp/gitea-patch.json
+          jq '{number, html_url}' /tmp/gitea-resp.json
+          jq -n --arg body "🔄 Re-ran $$STAMP — report above refreshed." '{body: $$body}' > /tmp/gitea-comment.json
+          gitea_write POST "$$API/issues/$$ISSUE/comments" /tmp/gitea-comment.json
         else
           echo "Creating new audit issue"
-          jq -n --arg title "$$TITLE" --arg body "$$BODY" \
-            '{title: $$title, body: $$body}' \
-            | curl -sf -X POST -H "Authorization: token $$GITEA_TOKEN" \
-                -H "Content-Type: application/json" --data @- \
-                "$$API/issues" | jq '{number, html_url, title}'
+          jq -n --arg title "$$TITLE" --arg body "$$(cat /tmp/update-audit.md)" \
+            '{title: $$title, body: $$body}' > /tmp/gitea-create.json
+          gitea_write POST "$$API/issues" /tmp/gitea-create.json
+          jq '{number, html_url, title}' /tmp/gitea-resp.json
         fi