chore(wiki): the service's Gitea token comes from apps/ai/wiki-service (write:repository) #948

2026-09-24T14:29:24Z

claude-bot commented

2026-09-24 14:29:24 +00:00

Prepares phase 4 (Wiki PR: POST /api/v1/facts). The service's note store used the Python service's read-only token; deposited facts are created as raw/<date>-<slug>.md through the Gitea contents API and need write. New claude-bot token wiki-service-write-2026-09-24 (write:repository) stored in OpenBao apps/ai/wiki-service, field gitea_token; the wiki-gitea ExternalSecret maps it. Commits by the service show as Claude Bot; captured_by in the frontmatter names the API key that deposited the fact.

🤖 Generated with Claude Code

Prepares phase 4 (Wiki PR: `POST /api/v1/facts`). The service's note store used the Python service's read-only token; deposited facts are created as `raw/<date>-<slug>.md` through the Gitea contents API and need write. New claude-bot token `wiki-service-write-2026-09-24` (`write:repository`) stored in OpenBao `apps/ai/wiki-service`, field `gitea_token`; the `wiki-gitea` ExternalSecret maps it. Commits by the service show as Claude Bot; `captured_by` in the frontmatter names the API key that deposited the fact. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-09-24 14:29:24 +00:00

chore(wiki): the service's Gitea token comes from apps/ai/wiki-service (write:repository)

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

64fdb568b4

Facts deposited through POST /api/v1/facts are committed as raw/ files.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

review-bot reviewed

2026-09-24 14:31:43 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit 64fdb568b4a51f45e2378b1aff4579c5094d8586.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Repoints the wiki-gitea ExternalSecret's Wiki__NoteStore__Gitea__Token field from OpenBao apps/ai/wiki-index to apps/ai/wiki-service (a new write:repository claude-bot token), so the wiki service can create raw/<date>-<slug>.md fact files via the Gitea contents API. This is a minimal, well-scoped one-line functional change plus an updated comment; the webhook secret's remoteRef (still apps/ai/wiki-index) is correctly left untouched. No blocking issues found.

🟡 Suggestions

kubernetes/apps/wiki/externalsecrets.yaml:20 — this change is only correct if the OpenBao secret apps/ai/wiki-service with field gitea_token already exists (per the PR body, it's the new token wiki-service-write-2026-09-24). That's outside this repo's diff and can't be verified from the checkout; worth confirming the OpenBao entry is in place before/at merge so external-secrets doesn't fail to sync and break the existing (read-only) token in the live wiki-gitea Secret.
Since the token scope is widening from read-only to write:repository, it may be worth a brief note (here or in the linked proposal) on what happens if fact deposits ever hit an unintended repo/path — i.e., confirming the token is scoped to only the notes repo, not a broader org-wide grant. Not blocking since token scoping is managed in Gitea/OpenBao, not in this file.

Tests

No tests apply — this is a one-field ExternalSecret change with no accompanying application code in the diff. Consistent with how the surrounding file's other ExternalSecret entries are handled (untested YAML).

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `64fdb568b4a51f45e2378b1aff4579c5094d8586`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Repoints the `wiki-gitea` ExternalSecret's `Wiki__NoteStore__Gitea__Token` field from OpenBao `apps/ai/wiki-index` to `apps/ai/wiki-service` (a new `write:repository` claude-bot token), so the wiki service can create `raw/<date>-<slug>.md` fact files via the Gitea contents API. This is a minimal, well-scoped one-line functional change plus an updated comment; the webhook secret's `remoteRef` (still `apps/ai/wiki-index`) is correctly left untouched. No blocking issues found. ## 🟡 Suggestions - `kubernetes/apps/wiki/externalsecrets.yaml:20` — this change is only correct if the OpenBao secret `apps/ai/wiki-service` with field `gitea_token` already exists (per the PR body, it's the new token `wiki-service-write-2026-09-24`). That's outside this repo's diff and can't be verified from the checkout; worth confirming the OpenBao entry is in place before/at merge so `external-secrets` doesn't fail to sync and break the existing (read-only) token in the live `wiki-gitea` Secret. - Since the token scope is widening from read-only to `write:repository`, it may be worth a brief note (here or in the linked proposal) on what happens if fact deposits ever hit an unintended repo/path — i.e., confirming the token is scoped to only the notes repo, not a broader org-wide grant. Not blocking since token scoping is managed in Gitea/OpenBao, not in this file. ## Tests No tests apply — this is a one-field ExternalSecret change with no accompanying application code in the diff. Consistent with how the surrounding file's other `ExternalSecret` entries are handled (untested YAML). ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit 1431c74fda into master

2026-09-24 14:50:45 +00:00

k.renner referenced this issue from a commit

2026-09-24 14:50:47 +00:00

Merge pull request 'chore(wiki): the service's Gitea token comes from apps/ai/wiki-service (write:repository)' (#948) from feat/wiki-service-write-token into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#948