game-operating was made private on Gitea, and the check quietly skipped the mirror comparison. A repo that IS mirrored but whose far side cannot be read is unverified, and unverified must not look like fine. It is now a finding that names the missing GITEA_TOKEN.
While testing that, a second bug surfaced: the header helper built 'Authorization: token: <value>' from a name that already contained the schema, producing a silently invalid header. The Authentik check had the same defect and would have failed the moment a token was added - it never ran, so nobody would have connected the two.
Refs axion1337.chat/management#28, #31
Looks for things that quietly stopped working. Every check mirrors a case that actually happened this month, named in its docstring: a repo that was never mirrored, mirror drift, pipelines with zero jobs, a successful job without artifacts, an npm package too small to contain a build, and Authentik blueprints stuck on error. Nothing is checked on suspicion.
The project list is read from the group at runtime rather than maintained in code - a hardcoded list is exactly where a new repo slips through for years. The first run proved the point by surfacing two projects nobody had in mind.
It aborts when a credential is missing instead of skipping quietly. A check that disables itself reports nothing for years and is indistinguishable from all clear.
Refs axion1337.chat/management#28
Thore Cimbal