fix: 🔒️ reject bare tokens in stateless HTTP auth #185

Merged

goern merged 0 commits from refs/pull/185/head into main 2026-06-01 21:53:56 +00:00

Conversation 14 Commits - Files changed -

goern commented 2026-06-01 21:42:17 +00:00 (Migrated from codeberg.org)

Copy link

Why

While verifying the stateless-http-auth OpenSpec change for archival, found one remaining spec violation. The spec's "Bare token rejected" scenario mandates:

transport MUST NOT accept tokens without a scheme prefix; a header value that does not match one of the two named schemes SHALL be treated as if no header were present.

But extractToken accepted scheme-less Authorization values, silently treating them as per-request identities. This is privilege-relevant: a bare value that should fall to the global singleton instead forges a per-request identity.

What changed

• operation/operation.go — extractToken returns "" for scheme-less headers; only token/bearer (case-insensitive) schemes resolve a token. (task 2.5)
• operation/extracttoken_test.go (new) — case-insensitivity (token/Bearer/BEARER/TOKEN) + bare-token rejection. (task 4.4)
• pkg/forgejo/forgejo_test.go — ephemeral-client construction failure surfaces an error and nil client, no silent singleton downgrade. (task 4.3)
• README.md — cross-link the stateless-http-auth OpenSpec change. (task 5.2)
• openspec/changes/stateless-http-auth/tasks.md — mark completed blocker fixes (1.3, 2.4, 2.5, 4.2–4.4, 5.x, 6.3).

The other blocker fixes (1.3 error propagation, 2.4 case-insensitive matching, 4.2 httptest header-leakage test) were already implemented on main; this PR closes the last gap.

Verification

• make build ✅
• go test ./... ✅ (no failures)
• openspec validate stateless-http-auth --strict ✅

Remaining before archive (post-merge)

• 6.4–6.6 manual smoke tests against a live instance
• 6.7 archive stateless-http-auth once merged

Closes the archival blocker for the stateless-http-auth change.

## Why While verifying the `stateless-http-auth` OpenSpec change for archival, found one remaining spec violation. The spec's "Bare token rejected" scenario mandates: > transport MUST NOT accept tokens without a scheme prefix; a header value that does not match one of the two named schemes SHALL be treated as if no header were present. But `extractToken` accepted scheme-less `Authorization` values, silently treating them as per-request identities. This is privilege-relevant: a bare value that should fall to the global singleton instead forges a per-request identity. ## What changed - **`operation/operation.go`** — `extractToken` returns `""` for scheme-less headers; only `token`/`bearer` (case-insensitive) schemes resolve a token. (task 2.5) - **`operation/extracttoken_test.go`** (new) — case-insensitivity (`token`/`Bearer`/`BEARER`/`TOKEN`) + bare-token rejection. (task 4.4) - **`pkg/forgejo/forgejo_test.go`** — ephemeral-client construction failure surfaces an error and nil client, no silent singleton downgrade. (task 4.3) - **`README.md`** — cross-link the `stateless-http-auth` OpenSpec change. (task 5.2) - **`openspec/changes/stateless-http-auth/tasks.md`** — mark completed blocker fixes (1.3, 2.4, 2.5, 4.2–4.4, 5.x, 6.3). The other blocker fixes (1.3 error propagation, 2.4 case-insensitive matching, 4.2 httptest header-leakage test) were already implemented on main; this PR closes the last gap. ## Verification - `make build` ✅ - `go test ./...` ✅ (no failures) - `openspec validate stateless-http-auth --strict` ✅ ## Remaining before archive (post-merge) - 6.4–6.6 manual smoke tests against a live instance - 6.7 archive `stateless-http-auth` once merged Closes the archival blocker for the `stateless-http-auth` change.

op1st-gitops commented 2026-06-01 21:42:27 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-l4cs6 is running.

Starting Pipelinerun forgejo-mcp-code-scans-l4cs6 in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-l4cs6 -f

op1st Pipelines as Code/forgejo-mcp-code-scans-l4cs6 is running. Starting Pipelinerun <b>[forgejo-mcp-code-scans-l4cs6](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-l4cs6)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-l4cs6) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-l4cs6 -f</code>

op1st-gitops commented 2026-06-01 21:42:27 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-hp6xk is running.

Starting Pipelinerun forgejo-mcp-openspec-validate-pr-hp6xk in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-hp6xk -f

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-hp6xk is running. Starting Pipelinerun <b>[forgejo-mcp-openspec-validate-pr-hp6xk](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hp6xk)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hp6xk) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-hp6xk -f</code>

op1st-gitops commented 2026-06-01 21:42:27 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-k98hd is running.

Starting Pipelinerun forgejo-mcp-on-pull-request-k98hd in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-k98hd -f

op1st Pipelines as Code/forgejo-mcp-on-pull-request-k98hd is running. Starting Pipelinerun <b>[forgejo-mcp-on-pull-request-k98hd](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-k98hd)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-k98hd) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-k98hd -f</code>

op1st-gitops commented 2026-06-01 21:42:57 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-l4cs6 has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-code-scans-l4cs6

---

Task Statuses:

Status	Duration	Name
Succeeded	19 seconds	fetch-source
Succeeded	9 seconds	gitleaks-version
Succeeded	11 seconds	gitleaks

op1st Pipelines as Code/forgejo-mcp-code-scans-l4cs6 has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-l4cs6">forgejo-mcp-code-scans-l4cs6</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>19 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-l4cs6/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-l4cs6/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-l4cs6/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-06-01 21:43:00 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-hp6xk has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-openspec-validate-pr-hp6xk

---

Task Statuses:

Status	Duration	Name
Succeeded	19 seconds	fetch-source
Succeeded	14 seconds	validate

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-hp6xk has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hp6xk">forgejo-mcp-openspec-validate-pr-hp6xk</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>19 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hp6xk/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hp6xk/logs/validate) </td></tr> </table>

op1st-gitops commented 2026-06-01 21:43:51 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-pktpx is running.

Starting Pipelinerun forgejo-mcp-on-pull-request-pktpx in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-pktpx -f

op1st Pipelines as Code/forgejo-mcp-on-pull-request-pktpx is running. Starting Pipelinerun <b>[forgejo-mcp-on-pull-request-pktpx](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-pktpx)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-pktpx) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-pktpx -f</code>

op1st-gitops commented 2026-06-01 21:43:51 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-n9bhc is running.

Starting Pipelinerun forgejo-mcp-openspec-validate-pr-n9bhc in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-n9bhc -f

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-n9bhc is running. Starting Pipelinerun <b>[forgejo-mcp-openspec-validate-pr-n9bhc](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-n9bhc)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-n9bhc) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-n9bhc -f</code>

op1st-gitops commented 2026-06-01 21:43:51 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-zrqs5 is running.

Starting Pipelinerun forgejo-mcp-code-scans-zrqs5 in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-zrqs5 -f

op1st Pipelines as Code/forgejo-mcp-code-scans-zrqs5 is running. Starting Pipelinerun <b>[forgejo-mcp-code-scans-zrqs5](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-zrqs5 -f</code>

op1st-gitops commented 2026-06-01 21:43:58 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-k98hd

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-on-pull-request-k98hd

---

Task Statuses:

Status	Duration	Name
Succeeded	16 seconds	fetch-source
Failed	1 minute	build-and-test
Succeeded	18 seconds	commit-title-check

---

Failure snippet:

task build-and-test has the status "TaskRunCancelled":

TaskRun "forgejo-mcp-on-pull-request-k98hd-build-and-test" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.

op1st Pipelines as Code/forgejo-mcp-on-pull-request-k98hd <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-k98hd">forgejo-mcp-on-pull-request-k98hd</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>16 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-k98hd/logs/fetch-source) </td></tr> <tr> <td>Failed</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-k98hd/logs/build-and-test) </td></tr> <tr> <td>Succeeded</td> <td>18 seconds</td><td> [commit-title-check](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-k98hd/logs/commit-title-check) </td></tr> </table> <hr> <h4>Failure snippet:</h4> task <b>build-and-test</b> has the status <b>"TaskRunCancelled"</b>: <pre>TaskRun "forgejo-mcp-on-pull-request-k98hd-build-and-test" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.</pre>

op1st-gitops commented 2026-06-01 21:44:22 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-n9bhc has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-openspec-validate-pr-n9bhc

---

Task Statuses:

Status	Duration	Name
Succeeded	16 seconds	fetch-source
Succeeded	13 seconds	validate

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-n9bhc has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-n9bhc">forgejo-mcp-openspec-validate-pr-n9bhc</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>16 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-n9bhc/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-n9bhc/logs/validate) </td></tr> </table>

op1st-gitops commented 2026-06-01 21:44:23 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-zrqs5 has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-code-scans-zrqs5

---

Task Statuses:

Status	Duration	Name
Succeeded	11 seconds	gitleaks-version
Succeeded	14 seconds	fetch-source
Succeeded	11 seconds	gitleaks

op1st Pipelines as Code/forgejo-mcp-code-scans-zrqs5 has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5">forgejo-mcp-code-scans-zrqs5</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-06-01 21:44:24 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-zrqs5 has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-code-scans-zrqs5

---

Task Statuses:

Status	Duration	Name
Succeeded	11 seconds	gitleaks-version
Succeeded	14 seconds	fetch-source
Succeeded	11 seconds	gitleaks

op1st Pipelines as Code/forgejo-mcp-code-scans-zrqs5 has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5">forgejo-mcp-code-scans-zrqs5</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zrqs5/logs/gitleaks) </td></tr> </table>

goern commented 2026-06-01 21:44:47 +00:00 (Migrated from codeberg.org)

Copy link

Tracking bead: forgejo-mcp-8if (P1) — after this PR merges, complete the remaining stateless-http-auth tasks and archive the change:

• 6.4–6.6 manual smoke tests (distinct per-request identities, lowercase bearer scheme, broken-URL error path) against a live instance
• 6.7 openspec archive stateless-http-auth

Bead recorded in .beads/issues.jsonl.

Tracking bead: **`forgejo-mcp-8if`** (P1) — after this PR merges, complete the remaining `stateless-http-auth` tasks and archive the change: - 6.4–6.6 manual smoke tests (distinct per-request identities, lowercase `bearer` scheme, broken-URL error path) against a live instance - 6.7 `openspec archive stateless-http-auth` Bead recorded in `.beads/issues.jsonl`.

op1st-gitops commented 2026-06-01 21:45:46 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-pktpx has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-on-pull-request-pktpx

---

Task Statuses:

Status	Duration	Name
Succeeded	14 seconds	fetch-source
Succeeded	1 minute	build-and-test
Succeeded	16 seconds	commit-title-check

op1st Pipelines as Code/forgejo-mcp-on-pull-request-pktpx has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-pktpx">forgejo-mcp-on-pull-request-pktpx</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-pktpx/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-pktpx/logs/build-and-test) </td></tr> <tr> <td>Succeeded</td> <td>16 seconds</td><td> [commit-title-check](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-pktpx/logs/commit-title-check) </td></tr> </table>

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/OpenSpec

OpenSpec change proposal / spec-driven work

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority/Critical

The priority is critical

  

Priority/High

The priority is high

  

Priority/Low

The priority is low

  

Priority/Medium

The priority is medium

  

RFC - Request For Comments

Request For Comments — design/spec open for feedback before implementation

  

Reviewed/Confirmed

Issue has been confirmed

  

Reviewed/Duplicate

This issue or pull request already exists

  

Reviewed/Invalid

Invalid issue

  

Reviewed/Won't Fix

This issue won't be fixed

  

Status/Abandoned

Somebody has started to work on this but abandoned work

  

Status/Blocked

Something is blocking this issue or pull request

  

Status/Need More Info

Feedback is required to reproduce issue or to continue work

  

hermes-attempted

Hermes attempted but produced no changes

  

hermes-needs-clarification

Quality gate flagged, needs human input

  

hermes-ready

Ready for hermes to process

  

hermes-review

Hermes PR awaiting review

  

hermes-wip

Hermes is working on this

  

human-required

Hermes gave up after 3 attempts

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/OpenSpec

Kind/Security

Kind/Testing

Priority/Critical

Priority/High

Priority/Low

Priority/Medium

RFC - Request For Comments

Reviewed/Confirmed

Reviewed/Duplicate

Reviewed/Invalid

Reviewed/Won't Fix

Status/Abandoned

Status/Blocked

Status/Need More Info

hermes-attempted

hermes-needs-clarification

hermes-ready

hermes-review

hermes-wip

human-required

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!185

No description provided.