[PR #264] [MERGED] Fix Renovate Trigger workflow auth fallback for rotated webhook tokens #156

New issue

Closed

opened 2026-06-08 08:30:25 +00:00 by ryangr0 · 0 comments

ryangr0 commented

2026-06-08 08:30:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/webgrip/homelab-cluster/pull/264
Author: @Copilot
Created: 5/25/2026
Status: ✅ Merged
Merged: 5/25/2026
Merged by: @Ryangr0

Base: main ← Head: copilot/fix-trigger-renovate-job

📝 Commits (2)

aa478d0 Initial plan
bceaabd fix(actions): retry renovate trigger with all webhook tokens

📊 Changes

1 file changed (+26 additions, -16 deletions)

View changed files

📝 .github/workflows/renovate-trigger.yml (+26 -16)

📄 Description

The Trigger Renovate workflow was failing because webhook calls returned 403 across projects. The trigger script only used the first token from renovate-webhook-auth, which breaks when that secret contains multiple comma-separated tokens and the first token is no longer valid.

Workflow trigger auth handling
- Updated .github/workflows/renovate-trigger.yml embedded Python to consume all tokens from renovate-webhook-auth (instead of tokens[0]).
- Renamed token loader from get_webhook_token() to get_webhook_tokens() to reflect behavior.
Retry/fallback behavior for webhook POST
- Updated post_webhook() to iterate tokens and retry on auth errors (401/403).
- Returns success immediately on first 2xx response.
- Preserves existing non-auth error handling (returns non-2xx for reporting/failure paths).

def post_webhook(project, webhook_tokens):
    last_auth_error = None
    for webhook_token in webhook_tokens:
        try:
            with urllib.request.urlopen(request_with(webhook_token)) as response:
                return response.status
        except HTTPError as error:
            if error.code in (401, 403):
                last_auth_error = error.code
                continue
            return error.code
    return last_auth_error if last_auth_error is not None else 500

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/webgrip/homelab-cluster/pull/264 **Author:** [@Copilot](https://github.com/apps/copilot-swe-agent) **Created:** 5/25/2026 **Status:** ✅ Merged **Merged:** 5/25/2026 **Merged by:** [@Ryangr0](https://github.com/Ryangr0) **Base:** `main` ← **Head:** `copilot/fix-trigger-renovate-job` --- ### 📝 Commits (2) - [`aa478d0`](https://github.com/webgrip/homelab-cluster/commit/aa478d0c5aeaa95732cd80226107a14578ba3c7e) Initial plan - [`bceaabd`](https://github.com/webgrip/homelab-cluster/commit/bceaabdf54fda599e6f62e7bc4b582291da3b430) fix(actions): retry renovate trigger with all webhook tokens ### 📊 Changes **1 file changed** (+26 additions, -16 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/renovate-trigger.yml` (+26 -16) </details> ### 📄 Description The `Trigger Renovate` workflow was failing because webhook calls returned `403` across projects. The trigger script only used the first token from `renovate-webhook-auth`, which breaks when that secret contains multiple comma-separated tokens and the first token is no longer valid. - **Workflow trigger auth handling** - Updated `.github/workflows/renovate-trigger.yml` embedded Python to consume all tokens from `renovate-webhook-auth` (instead of `tokens[0]`). - Renamed token loader from `get_webhook_token()` to `get_webhook_tokens()` to reflect behavior. - **Retry/fallback behavior for webhook POST** - Updated `post_webhook()` to iterate tokens and retry on auth errors (`401`/`403`). - Returns success immediately on first `2xx` response. - Preserves existing non-auth error handling (returns non-2xx for reporting/failure paths). ```python def post_webhook(project, webhook_tokens): last_auth_error = None for webhook_token in webhook_tokens: try: with urllib.request.urlopen(request_with(webhook_token)) as response: return response.status except HTTPError as error: if error.code in (401, 403): last_auth_error = error.code continue return error.code return last_auth_error if last_auth_error is not None else 500 ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

ryangr0

2026-06-08 08:30:25 +00:00