[P16] Sync rotated credentials to Woodpecker secrets #112

New Issue

kert · 2026-03-22T17:12:53Z

kert commented

2026-03-22 17:12:53 +00:00

Problem

Provision rotates credentials in .env and PostgreSQL/Gitea backends, but Woodpecker secrets (registry_user, registry_pass, gitea_token, s3_access_key, s3_secret_key) are NOT updated. The next pipeline run uses stale secrets.

Currently these secrets are manually configured in the Woodpecker UI and never rotated.

Fix

After rotating credentials, call the Woodpecker API to update repo secrets:

from api.clients.woodpecker import WoodpeckerClient

wp = WoodpeckerClient(gitea_token)
wp.update_repo_secret(repo_id, 'gitea_token', new_token)
wp.update_repo_secret(repo_id, 'registry_pass', new_pass)

Woodpecker API: PATCH /api/repos/{repo_id}/secrets/{name} with {"value": "..."}

Secrets to sync

Woodpecker Secret	Source
`gitea_token`	`GITEA_TOKEN` (rotated by provision_gitea)
`registry_pass`	`GITEA_ADMIN_PASSWORD` (rotated by derive_all)
`s3_access_key`	`RUSTFS_ACCESS_KEY` (rotated by derive_all)
`s3_secret_key`	`RUSTFS_SECRET_KEY` (rotated by derive_all)

Acceptance criteria

provision_woodpecker() function updates all 4 secrets via API
Uses the freshly-created GITEA_TOKEN for auth
Idempotent (works on re-run)
Tested with mocked Woodpecker client

## Problem Provision rotates credentials in `.env` and PostgreSQL/Gitea backends, but Woodpecker secrets (`registry_user`, `registry_pass`, `gitea_token`, `s3_access_key`, `s3_secret_key`) are NOT updated. The next pipeline run uses stale secrets. Currently these secrets are manually configured in the Woodpecker UI and never rotated. ## Fix After rotating credentials, call the Woodpecker API to update repo secrets: ```python from api.clients.woodpecker import WoodpeckerClient wp = WoodpeckerClient(gitea_token) wp.update_repo_secret(repo_id, 'gitea_token', new_token) wp.update_repo_secret(repo_id, 'registry_pass', new_pass) ``` Woodpecker API: `PATCH /api/repos/{repo_id}/secrets/{name}` with `{"value": "..."}` ## Secrets to sync | Woodpecker Secret | Source | |---|---| | `gitea_token` | `GITEA_TOKEN` (rotated by provision_gitea) | | `registry_pass` | `GITEA_ADMIN_PASSWORD` (rotated by derive_all) | | `s3_access_key` | `RUSTFS_ACCESS_KEY` (rotated by derive_all) | | `s3_secret_key` | `RUSTFS_SECRET_KEY` (rotated by derive_all) | ## Acceptance criteria - [ ] `provision_woodpecker()` function updates all 4 secrets via API - [ ] Uses the freshly-created GITEA_TOKEN for auth - [ ] Idempotent (works on re-run) - [ ] Tested with mocked Woodpecker client

kert added this to the P16: Provision Hardening — resilient credential rotation milestone 2026-03-22 17:12:53 +00:00

kert added the ci label 2026-03-22 17:12:53 +00:00

kert referenced this issue from a commit

2026-03-22 17:32:24 +00:00

harden provision: API-only Gitea, safe SQL, retry, Woodpecker sync

kert closed this issue

2026-03-22 17:32:24 +00:00

Sign in to join this conversation.