coily ops forgejo: use HTTPS for all verbs, drop SSH #139
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
Some
coily ops forgejoverbs reach the Forgejo instance over SSH (in-podkubectl exec/ SSH to kai-server) rather than the HTTP API. None of them should.Every forgejo verb should use HTTPS against the Forgejo API.
Why
SSH-backed verbs fail in any session without an SSH key loaded into the agent.
Hit today:
coily ops forgejo actions task logsreturnsbecause it does an in-pod log read over SSH to kai-server. This made CI logs
unreadable from a Claude session and blocked root-causing a release failure.
By contrast,
issue create,release create/list, andactions task listalready work over HTTP from the same session - proving the HTTPS path is viable.
Scope
coily ops forgejoverb for SSH /kubectl execdependence./forgejo/api-token,same auth pattern the working HTTP verbs already use).
actions task logs(in-pod decoded-log read). The ForgejoActions API exposes task logs over HTTP - use that instead of SSH.
Acceptance
coily ops forgejoverb requires SSH or an in-pod exec.actions task logsworks from a session with no SSH key loaded.Scope:
actions task logsconverted; admin/doctor verbs deferredAudited every
coily ops forgejoverb against the live Forgejo 15.0.2 API.Converted to HTTPS (this change)
actions task logs- was the motivating offender (in-podcat | zstd -dover SSH). Forgejo's API v1 has no log endpoint, so it now drives the
same web route the Actions UI uses:
POST /{owner}/{repo}/actions/runs/{run}/jobs/{job}/attempt/{n}with alogCursorsbody, resolving the task id to its run+job by name andreassembling the per-step log lines. Works from a session with no SSH key.
Cannot convert - no HTTP API exists
doctor check-forgejo doctoris a CLI-only maintenance command. No API.admin auth list- no auth-sources listing endpoint in the API.These two have to stay on the in-pod
forgejoCLI path (SSH / kubectl exec)unless we drop the verbs entirely.
Convertible later (deferred)
admin user list-GET /admin/usersexists; clean conversion, just notin scope for this pass.
admin user create-POST /admin/usersexists but takes a password in thebody. Today the verb uses in-pod
--random-passwordso the secret neverreaches coily's argv/audit log; converting changes that credential model and
deserves its own discussion.
Proposal
Close this issue once
actions task logslands. Trackadmin user listconversion as a small follow-up, and treat
doctor check/admin auth listas accepted SSH carve-outs (no API to convert to).