Skip to content

fix(secret): use refresh=True to always use latest secret revision #779

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cbartz merged 2 commits into from
Apr 14, 2026
Merged

fix(secret): use refresh=True to always use latest secret revision #779

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8112fa4
fix(secret): use refresh=True to always use latest secret revision
cbartz Apr 13, 2026
a4e3157
docs(changelog): add entry for secret refresh fix
cbartz Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions docs/changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@

This changelog documents user-relevant changes to the GitHub runner charm.

## 2026-04-13

- Fixed Juju secrets not picking up new revisions. The charm now uses `refresh=True` when reading secret contents, ensuring it always retrieves the latest revision instead of a cached one.

## 2026-04-07

- Add GitHub App authentication support using Juju secrets for the private key, alongside the existing PAT-based authentication.
Expand Down
5 changes: 2 additions & 3 deletions src/charm_state.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,7 @@ def from_charm(cls, charm: CharmBase) -> "GithubConfig": # noqa: C901
if private_key_secret_id:
try:
private_key_secret = charm.model.get_secret(id=private_key_secret_id)
private_key = private_key_secret.get_content().get("private-key")
private_key = private_key_secret.get_content(refresh=True).get("private-key")
except SecretNotFoundError as exc:
raise CharmConfigInvalidError(
f"GitHub App private key secret {private_key_secret_id} not found"
Expand Down Expand Up @@ -808,8 +808,7 @@ def _build_planner_config_from_charm(charm: CharmBase) -> PlannerConfig | None:
return None
try:
token_secret = charm.model.get_secret(id=token_secret_id)
# no need for refresh - there shouldn't be multiple secret revisions
token_content = token_secret.get_content()
token_content = token_secret.get_content(refresh=True)
token = token_content.get("token")
if not token:
logger.warning(
Expand Down
2 changes: 2 additions & 0 deletions tests/unit/test_charm_state.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ def test_github_config_from_charm_app_only():
assert result.installation_id == 456
assert result.private_key == "private-key-pem"
mock_charm.model.get_secret.assert_called_once_with(id="secret:abc123")
secret_mock.get_content.assert_called_once_with(refresh=True)


@pytest.mark.parametrize(
Expand Down Expand Up @@ -769,6 +770,7 @@ def test_planner_config_from_charm_extracts_endpoint_token():
endpoint="http://planner.example.com", token="planner-token-value"
)
mock_charm.model.get_secret.assert_called_once_with(id="secret:abc123")
secret_mock.get_content.assert_called_once_with(refresh=True)


def test_planner_config_from_charm_no_relation():
Expand Down
Loading