GitHub: Stale user token preventing builds from running (?)

[pat-s]

When using WP with GH, everything works fine for a short period of time (some hours) after being logged in freshly.

However, it seems that after some time the user token expires and builds are not triggered anymore

 {"level":"error","error":"Error #01: GET https://api.github.com/repos/<repo-slug>branches?page=1&per_page=50: 401 Bad credentials []\n","ip":"159.100.253.188","latency":265.980774,"method":"GET" │
│ ,"path":"/api/repos/2/branches","status":500,"time":"2023-09-20T07:56:03Z","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 │
│ ","time":"2023-09-20T07:56:03Z"}  

This is especially problematic for CRON builds as these are never triggered then. Also the UI reflects this by showing the following banner

A logout and fresh login solves the issue. I wonder: is this something that must be solved on the user side? Which token is actually used here which could expire? The GH auth runs via a self-hosted GH app which is using a client ID and secret.

How is this being handled for the WP instance running in the woodpecker repo here?

[qwerty287]

Actually, oauth2 tokens which are used for forge authentication are refreshed if a cron is executed.

[pat-s]

We use the GH app as described in the docs.

What is different in the WP instance of this repo? There I never get these stale token issues.
Is it a setting in the GH app I am missing?

Most users probably only use gitea with WP and not GH - which is why maybe nobody else faced the issue before?

[pat-s]

This is an active issue for us right now and I wonder how we can solve it or if it's really something which must be tackled inside WP.

In https://ci.woodpecker-ci.org/repos I don't face the same issues 🤔 . In our private instance instead I also get the red banner sign from above when just going to the repo overview - after the taken got stale.

Happy to open an issue and provide more logs if needed.

next-1653a8eadf

[qwerty287]

Yes, since that's a bug, it should be moved to issues

[runephilosof-karnovgroup]

We use the GH app as described in the docs.

The Woodpecker docs does not mention whether to create Woodpecker as a Github App or as an Oauth app.
It does not seem like tokens need to be refreshed, if installed as an Oauth app. The Github docs does not mention refreshing Oauth token https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app#implementing-persistent-authentication.