The handler was silent on success, unauthorized signatures, and unhandled
events, making it impossible to tell from server logs alone whether a
delivery even arrived. Now every request logs its event type and resulting
status code.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Missing closing " made yaml.v3 read to EOF looking for the string's end,
crash-looping the bot on startup with "found unexpected end of stream".
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Only config.yaml was bind-mounted into the container, so phrases_file's
default "./phrases.yaml" had nothing to resolve to at runtime and the bot
crash-looped on startup. phrases.yaml is repo-tracked source, not a secret,
so it belongs in the image like the binary itself.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
config.yaml previously mixed secrets with the phrase list, forcing
private-only edits. Now config supports phrases_file, which is loaded and
merged with any private phrases: entries, so the repo-tracked phrases.yaml
can be extended via PR while per-deployment additions stay private.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
runs-on selects a registered runner label; forgejo-runner's default
label is ubuntu-latest, so the job never got picked up under "docker".
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Watches issue/PR comments and pushes for flagged phrases; warns commenters
via reply and opens a redacted correction PR for flagged file content,
never rewriting history or deleting content directly.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
