Make agentpr's Vault gitea creds path selectable #8

2026-08-30T00:50:50+10:00

unkin-agent commented

2026-08-30 00:50:50 +10:00

Why

agentpr read gitea/creds/unkin-agent from a bare const with no override, so a service like repospawner could not run it as its own Gitea identity — every PR it opened was attributed to unkin-agent. AGENT_LOGIN existed but only fed watchpr's self-comment filter and agentws's git identity.

How

GiteaCredsPath becomes a function: GITEA_CREDS_PATH when set, otherwise gitea/creds/<AGENT_LOGIN>. With neither set it resolves to gitea/creds/unkin-agent exactly as before, so nothing existing changes.
The path is threaded through fetchGiteaToken / readGiteaCreds rather than read from a package const, and it now appears in the Vault error messages.
agentpr's Short/Long/whoami help text is login-agnostic; README and AGENTS.md document both variables.

So AGENT_LOGIN=repospawner agentpr pr create ... reads gitea/creds/repospawner and posts as repospawner.

Tests

New internal/agent/token_test.go: table test over default / AGENT_LOGIN-derived / GITEA_CREDS_PATH precedence / trimming, plus httptest-backed tests asserting the exact Vault path read and that whoami and PR creation then run as the selected identity. go test -race, gofmt, go vet, golangci-lint and pre-commit all clean.

## Why `agentpr` read `gitea/creds/unkin-agent` from a bare const with no override, so a service like **repospawner** could not run it as its *own* Gitea identity — every PR it opened was attributed to `unkin-agent`. `AGENT_LOGIN` existed but only fed watchpr's self-comment filter and agentws's git identity. ## How - `GiteaCredsPath` becomes a function: `GITEA_CREDS_PATH` when set, otherwise `gitea/creds/<AGENT_LOGIN>`. With neither set it resolves to `gitea/creds/unkin-agent` exactly as before, so nothing existing changes. - The path is threaded through `fetchGiteaToken` / `readGiteaCreds` rather than read from a package const, and it now appears in the Vault error messages. - `agentpr`'s Short/Long/whoami help text is login-agnostic; README and AGENTS.md document both variables. So `AGENT_LOGIN=repospawner agentpr pr create ...` reads `gitea/creds/repospawner` and posts as repospawner. ## Tests New `internal/agent/token_test.go`: table test over default / `AGENT_LOGIN`-derived / `GITEA_CREDS_PATH` precedence / trimming, plus httptest-backed tests asserting the exact Vault path read and that whoami and PR creation then run as the selected identity. `go test -race`, gofmt, `go vet`, golangci-lint and pre-commit all clean.

unkin-agent added 1 commit 2026-08-30 00:50:50 +10:00

Make the Vault gitea creds path selectable

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

26cd05e961

agentpr always read gitea/creds/unkin-agent from a bare const, so a service
like repospawner could not run it as its own Gitea identity.

- Replace the GiteaCredsPath const with a function: GITEA_CREDS_PATH when set,
  otherwise gitea/creds/<AGENT_LOGIN>. Unset env still resolves to
  gitea/creds/unkin-agent, so existing callers are unchanged.
- Thread the creds path through fetchGiteaToken/readGiteaCreds instead of
  reading a package-level const, and report it in the error messages.
- Make agentpr's help text login-agnostic and document both variables.

benvin merged commit 47118215b4 into main

2026-08-30 09:36:23 +10:00

benvin deleted branch benvin/agentpr-creds-path

2026-08-30 09:36:23 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/agent-tools#8