From 8112fa4633c4706e4aeaf588f5add875a0e10f17 Mon Sep 17 00:00:00 2001
From: Christopher Bartz <christopher.bartz@canonical.com>
Date: Mon, 13 Apr 2026 15:25:53 +0200
Subject: [PATCH 1/2] fix(secret): use refresh=True to always use latest secret
 revision

---
 src/charm_state.py             | 5 ++---
 tests/unit/test_charm_state.py | 2 ++
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/charm_state.py b/src/charm_state.py
index c17a10b3b2..49f0e8ff4a 100644
--- a/src/charm_state.py
+++ b/src/charm_state.py
@@ -205,7 +205,7 @@ def from_charm(cls, charm: CharmBase) -> "GithubConfig":  # noqa: C901
         if private_key_secret_id:
             try:
                 private_key_secret = charm.model.get_secret(id=private_key_secret_id)
-                private_key = private_key_secret.get_content().get("private-key")
+                private_key = private_key_secret.get_content(refresh=True).get("private-key")
             except SecretNotFoundError as exc:
                 raise CharmConfigInvalidError(
                     f"GitHub App private key secret {private_key_secret_id} not found"
@@ -808,8 +808,7 @@ def _build_planner_config_from_charm(charm: CharmBase) -> PlannerConfig | None:
         return None
     try:
         token_secret = charm.model.get_secret(id=token_secret_id)
-        # no need for refresh - there shouldn't be multiple secret revisions
-        token_content = token_secret.get_content()
+        token_content = token_secret.get_content(refresh=True)
         token = token_content.get("token")
         if not token:
             logger.warning(
diff --git a/tests/unit/test_charm_state.py b/tests/unit/test_charm_state.py
index 6e17080f35..1bef202674 100644
--- a/tests/unit/test_charm_state.py
+++ b/tests/unit/test_charm_state.py
@@ -133,6 +133,7 @@ def test_github_config_from_charm_app_only():
     assert result.installation_id == 456
     assert result.private_key == "private-key-pem"
     mock_charm.model.get_secret.assert_called_once_with(id="secret:abc123")
+    secret_mock.get_content.assert_called_once_with(refresh=True)
 
 
 @pytest.mark.parametrize(
@@ -769,6 +770,7 @@ def test_planner_config_from_charm_extracts_endpoint_token():
         endpoint="http://planner.example.com", token="planner-token-value"
     )
     mock_charm.model.get_secret.assert_called_once_with(id="secret:abc123")
+    secret_mock.get_content.assert_called_once_with(refresh=True)
 
 
 def test_planner_config_from_charm_no_relation():

From a4e3157bef7d97d8682fb5c3a07ee1d6d9f2165f Mon Sep 17 00:00:00 2001
From: Christopher Bartz <christopher.bartz@canonical.com>
Date: Mon, 13 Apr 2026 22:37:10 +0200
Subject: [PATCH 2/2] docs(changelog): add entry for secret refresh fix

---
 docs/changelog.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/changelog.md b/docs/changelog.md
index b3a52b4d98..93bf02c8a4 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -2,6 +2,10 @@
 
 This changelog documents user-relevant changes to the GitHub runner charm.
 
+## 2026-04-13
+
+- Fixed Juju secrets not picking up new revisions. The charm now uses `refresh=True` when reading secret contents, ensuring it always retrieves the latest revision instead of a cached one.
+
 ## 2026-04-07
 
 - Add GitHub App authentication support using Juju secrets for the private key, alongside the existing PAT-based authentication.