From f5c97117d6372a48c6ea0db433175461b118226e Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Tue, 4 Aug 2026 16:55:59 +0000 Subject: [PATCH] bridge: bump gitea-token swarm secret to v3 (fix silent !testme drop) The July gitea credential rotation updated the sops value, but ensure_secret is create-once-immutable, so the service kept mounting cc_ci_bridge_gitea_token_v1 frozen at the pre-rotation token -> HTTP 401 'user does not exist' on every !testme poll, silently dropping all triggers (found + worked around Drone-direct during the 2026-08-03 weekly run; a manually-created _v2 existed but nothing referenced it). Referencing _v3 makes the reconcile unit mint a fresh swarm secret from the CURRENT /run/secrets/bridge_gitea_token (verified: HTTP 200 as autonomic-bot) at next deploy. --- nix/modules/bridge.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nix/modules/bridge.nix b/nix/modules/bridge.nix index 07c00e3..b8fb6fe 100644 --- a/nix/modules/bridge.nix +++ b/nix/modules/bridge.nix @@ -72,7 +72,7 @@ let name: cc_ci_bridge_drone_token_v1 gitea_token: external: true - name: cc_ci_bridge_gitea_token_v1 + name: cc_ci_bridge_gitea_token_v3 ''; reconcile = pkgs.writeShellApplication { @@ -95,7 +95,7 @@ let } ensure_secret /run/secrets/bridge_webhook_hmac cc_ci_bridge_webhook_hmac_v1 ensure_secret /run/secrets/bridge_drone_token cc_ci_bridge_drone_token_v1 - ensure_secret /run/secrets/bridge_gitea_token cc_ci_bridge_gitea_token_v1 + ensure_secret /run/secrets/bridge_gitea_token cc_ci_bridge_gitea_token_v3 docker stack deploy --detach=true -c ${stack} ccci-bridge '';