pal-e-docs

TODO: Fix Woodpecker webhook token signatures (post-Postgres migration)

todo-woodpecker-webhook-token-fix Todo

todo done platform ci
Project

TODO: Fix Woodpecker webhook token signatures

Status: Open. Discovered 2026-03-14. Blocking merge=deploy automation.
Priority: HIGH — this breaks the entire CI automation chain. Merge does NOT trigger pipelines.

Problem

Woodpecker server logs show "token signature is invalid: failure to parse token from hook" for every Forgejo webhook delivery. The Postgres migration (PR #59) created a fresh DB with new JWT signing keys. The Forgejo webhook secrets for all 28 repos still use the old key. Repos were re-activated in Woodpecker, but the webhook token rotation didn't propagate to Forgejo.

Impact

  • Merge to main does NOT trigger Woodpecker pipelines
  • PR creation does NOT trigger plan-on-PR validation
  • Manual pipeline triggers still work (Woodpecker UI or API)
  • This breaks the "merge = deploy" DORA Elite automation for all repos

Fix

For each of the 28 activated repos:
  • In Woodpecker UI: deactivate then re-activate the repo (regenerates webhook with correct secret)
  • OR: In Forgejo repo settings → Webhooks, update the Woodpecker webhook secret to match the new signing key
  • Verify with a test push that the pipeline triggers
Batch approach: script the deactivate/re-activate cycle via Woodpecker API for all 28 repos.

Also fix (probe URL nits from Phase 14)

  • Forgejo probe: port 3000 → port 80 (k8s Service uses port 80)
  • Keycloak probe: port 8080 → remove port (Service maps 80→8080), or use management port 9000 for /health/ready
  • basketball-api probe: /api/health → valid endpoint (returns 404)
  • pal-e-docs probe: /api/health → verify endpoint exists (got 502 during pod restart)
  • platform-validation probe: check if Tailscale funnel is active
  • plan-pal-e-platform — should be Phase 14 epilogue or new subphase
  • phase-pal-e-platform-14-synthetic-monitoring — probe URLs are nits from this phase
  • Lesson: "Woodpecker API token rotates with DB" in deployment-lessons