0164c8cb4e
The 2026-10-01 monthly drill passed but the post-run webhook got HTTP 401 from the home Paperclip. Root cause: the home server's global actorMiddleware (/app/server/src/middleware/auth.ts) rejects every Authorization: Bearer <...> that is not a board API key or an agent JWT before per-route handlers run, so the trigger's own `bearer` signingMode handler is unreachable with a 48-hex random secret. Only publicMcpGatewayProtocolPath is exempted. Fix: - Trigger 6983798e-018c-459d-95ea-4b5959441e2d switched to signingMode: github_hmac via PATCH (secret unchanged). - post_webhook now computes HMAC-SHA256(body, secret) with openssl (already in alpine/k8s) and sends X-Hub-Signature-256 instead of Authorization: Bearer. HMAC headers bypass the Bearer branch of the global middleware entirely. Verified end-to-end: synthetic HMAC-signed body posted to .../fire returned 202 issue_created and spawned DEV-591 under parent DEV-578. SealedSecret is unchanged (same secret value reused as the HMAC key). Co-Authored-By: Paperclip <noreply@paperclip.ing> |
||
|---|---|---|
| .. | ||
| restore-drill | ||
| schedules | ||
| prometheusrule.yaml | ||
| servicemonitor.yaml | ||