From 4acf22645565d53c92142c13cfcc520dea11e862 Mon Sep 17 00:00:00 2001 From: TZGyn Date: Sun, 25 Oct 2026 15:03:33 +0800 Subject: [PATCH] Document the real webhook root causes (hook secret edits ignored, SHA tip fetch) --- AGENTS.md | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 80e9546..510c50c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -56,11 +56,22 @@ what we take vs. skip). Never vendor it into the build. so it matches fine. A curl replay needs `X-Gitea-Event: push` and the signature header, or it answers "No matching application or invalid signature." - The app's `manual_webhook_secret_gitea` is **regenerated whenever the app - is recreated** — if the Coolify app is ever recreated, update the Gitea - hook's secret too (`PATCH /repos/TZGyn/tunnel/hooks/5` with - `{"config":{"secret":""}}`), or real deliveries silently fail - signature checks while curl replays still work. + Coolify's audit log (MCP `list_audit_events`, `source=webhook`) is the + debugging oracle: `webhook.deployment.queued` = authenticated and queued, + `webhook.gitea.signature_failed` = the Gitea hook's secret does not match + the app's current `manual_webhook_secret_gitea`. + **Gitea's hook edit API does not update the stored secret** — PATCHing the + hook returns 200 but deliveries keep failing signature checks; delete the + hook and create a fresh one with the secret instead (current hook: id 6, + branch_filter `main`). The app's secret is regenerated whenever the app is + recreated, so recreate the hook after any app recreation. + Coolify's webhook deploy pins the pushed commit (`git fetch origin `), + and this Gitea only serves the *current tip* by SHA + (`uploadpack.allowReachableSHA1InWant` is off; other SHAs fail with + "not our ref"). Deploys fail if a later push lands before the fetch — + re-trigger the deploy. Proper fix, inside the Gitea container: + `git -C /data/git/repositories/TZGyn/tunnel.git config + uploadpack.allowReachableSHA1InWant true`. This Coolify version stores `custom_labels` **base64-encoded** and does *not* merge its generated Traefik labels for API-created apps: the full label set must live in `custom_labels` (mirror a working app's generated