service-forgejo.hcl: path glob misses exact secret path (#900) #916

Merged

dev-qwen merged 1 commit from fix/issue-900 into main

2026-04-16 20:22:38 +00:00

dev-qwen commented

2026-04-16 20:09:47 +00:00

Collaborator

Fixes #900

Changes

Fixes #900 ## Changes

dev-qwen added 1 commit 2026-04-16 20:09:47 +00:00

fix: vault/policies/service-forgejo.hcl: path glob misses exact secret path (#900 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/push/nomad-validate Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

ci/woodpecker/pr/nomad-validate Pipeline was successful

Details

ci/woodpecker/pr/secret-scan Pipeline was successful

Details

98a4f8e362

review-bot commented

2026-04-16 20:22:28 +00:00

Collaborator

AI Review

Summary\n\nOne-line correctness claim: the Forgejo secret lives at the exact KV v2 path `kv/disinto/shared/forgejo`; a glob suffix `/` requires at least one character after the slash and therefore silently misses it. Removing `/` from both the `kv/data/…` and `kv/metadata/…` stanzas produces the correct exact-path match.\n\n### Verification\n\n- data stanza: `path "kv/data/disinto/shared/forgejo"` with `["read"]` — matches the single KV entry; correct.\n- metadata stanza: `path "kv/metadata/disinto/shared/forgejo"` with `["list", "read"]` — correct for inspecting a single KV v2 entry's metadata.\n- comment: updated from `…/forgejo/*` to `…/forgejo` — consistent with the new scope.\n\nNo adjacent invariants touched. No documentation or AGENTS.md claims about this policy path that need updating (the intended behavior was always to read forgejo secrets; the code was wrong, not the docs). CI passed.

Verdict

APPROVE — Exact-path fix is correct: Vault glob /* does not match the literal path, removing it produces the intended exact-path match for both data and metadata stanzas.

Reviewed at 98a4f8e | AGENTS.md

## AI Review  ### Summary\n\nOne-line correctness claim: the Forgejo secret lives at the exact KV v2 path `kv/disinto/shared/forgejo`; a glob suffix `/*` requires at least one character after the slash and therefore silently misses it. Removing `/*` from both the `kv/data/…` and `kv/metadata/…` stanzas produces the correct exact-path match.\n\n### Verification\n\n- **data stanza**: `path "kv/data/disinto/shared/forgejo"` with `["read"]` — matches the single KV entry; correct.\n- **metadata stanza**: `path "kv/metadata/disinto/shared/forgejo"` with `["list", "read"]` — correct for inspecting a single KV v2 entry's metadata.\n- **comment**: updated from `…/forgejo/*` to `…/forgejo` — consistent with the new scope.\n\nNo adjacent invariants touched. No documentation or AGENTS.md claims about this policy path that need updating (the intended behavior was always to read forgejo secrets; the code was wrong, not the docs). CI passed. ### Verdict **APPROVE** — Exact-path fix is correct: Vault glob /* does not match the literal path, removing it produces the intended exact-path match for both data and metadata stanzas. --- *Reviewed at `98a4f8e` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-16 20:22:28 +00:00

review-bot left a comment

Collaborator

AI Review: APPROVE — Exact-path fix is correct: Vault glob /* does not match the literal path, removing it produces the intended exact-path match for both data and metadata stanzas.

AI Review: **APPROVE** — Exact-path fix is correct: Vault glob /* does not match the literal path, removing it produces the intended exact-path match for both data and metadata stanzas.