vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: keep the webhook secret on read errors; surface hidden KV/auth/forge failures

Browse source 
- swarm-controller webhook: regenerate the secret only when the file is
  absent. Any other read error is returned with the path; the caller
  already logs "webhook secret unavailable" and the endpoint answers 503.
  Overwriting meant every registered hook kept the old secret and every
  delivery failed HMAC, with nothing re-registering them.
- swarm-queue-client wanted: open_read_only/watch return Result; only
  STREAM_NOT_FOUND on the bucket maps to None. hive-c0re's wanted pull
  fails the DAG node with the cause instead of logging "nothing has been
  declared"; the watch warns with the error chain.
- swarm-nats-auth: warn when the OIDC secret re-read task dies.
- swarm-controller forge: listing a repo's config PRs failing is warn,
  not debug.

Closes #5056
This commit is contained in:
atlas 2026-10-09 13:01:50 +02:00 • committed by mara
commit 7129ee0015
6 changed files with 147 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

33
hive-c0re/src/workers/wanted.rs
View file

@ -63,7 +63,10 @@ pub async fn pull(coord: &Arc<Coordinator>) -> Result<()> {
// A hung node is worse than a failed one: the dashboard shows it running.
swarm_queue_client::ensure_connected(&client)?;
let Some(store) = swarm_queue_client::wanted::open_read_only(&client, &hive).await else {
let Some(store) = swarm_queue_client::wanted::open_read_only(&client, &hive)
.await
.context("opening this hive's wanted-state bucket")?
else {
tracing::info!(%hive, "wanted state: no bucket yet; nothing has been declared");
return Ok(());
};
@ -89,7 +92,7 @@ pub async fn pull(coord: &Arc<Coordinator>) -> Result<()> {
///
/// ⚠️ A refused watch and a quiet one are told apart here, unlike the core-NATS
/// subscriptions in [`crate::swarm_status`]: a watch is a `JetStream` consumer,
/// so the request is answered, and a hive lacking the grant gets `None` rather
/// so the request is answered, and a hive lacking the grant gets an error rather
/// than silence. That is why this warns instead of returning quietly.
pub async fn watch_declarations(
client: async_nats::Client,
@ -99,13 +102,25 @@ pub async fn watch_declarations(
) {
use futures_util::StreamExt as _;
let Some(mut updates) = swarm_queue_client::wanted::watch(&client, &hive).await else {
tracing::warn!(
%hive,
"wanted state: cannot watch this hive's bucket; changes will be \
picked up at the next boot instead"
);
return;
let mut updates = match swarm_queue_client::wanted::watch(&client, &hive).await {
Ok(Some(updates)) => updates,
Ok(None) => {
tracing::warn!(
%hive,
"wanted state: cannot watch this hive's bucket; changes will be \
picked up at the next boot instead"
);
return;
}
Err(e) => {
tracing::warn!(
%hive,
error = %swarm_queue_client::chain(&e),
"wanted state: cannot watch this hive's bucket; changes will be \
picked up at the next boot instead"
);
return;
}
};
tracing::info!(%hive, "wanted state: watching for declarations");