From 3bf51f44d5b1da1f397230fdb4b6922704cda879 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Thu, 29 Oct 2026 18:51:34 +0400
Subject: [PATCH] kredits-github: fix webhook path and restart on unit changes

Probot 14 changed its default webhook path from "/" (Probot 7) to
"/api/github/webhooks", but the GitHub App still POSTs to
https://kredits-github.kosmos.org/. Every delivery returned 404, so the
app never processed pull_request events and never created the Kredits
check run. Serve "/" again via WEBHOOK_PATH.

Chef's systemd_unit :create only runs daemon-reload and never restarts a
running unit, so the env change above would not have taken effect until
the next repo change or reboot. Manage the unit with :create/:enable and
restart it from a service resource that subscribes to unit changes.
Apply the same fix to the kosmos-hubot bot resource.
---
 site-cookbooks/kosmos-hubot/resources/bot.rb     | 12 ++++++++++--
 site-cookbooks/kredits-github/recipes/default.rb | 16 ++++++++++++++--
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/site-cookbooks/kosmos-hubot/resources/bot.rb b/site-cookbooks/kosmos-hubot/resources/bot.rb
index ca665b3..abedfd4 100644
--- a/site-cookbooks/kosmos-hubot/resources/bot.rb
+++ b/site-cookbooks/kosmos-hubot/resources/bot.rb
@@ -54,7 +54,7 @@ action :create do
     group      app_group
     repository new_resource.repository
     revision   new_resource.revision
-    notifies :restart, "systemd_unit[#{app_name}.service]", :delayed
+    notifies :restart, "service[#{app_name}]", :delayed
   end
 
   execute "npm install (#{app_name})" do
@@ -123,6 +123,14 @@ action :create do
     content unit
     verify false
     triggers_reload true
-    action [:create, :enable, :start]
+    action [:create, :enable]
+  end
+
+  # `systemd_unit` only reloads the daemon and never restarts a running unit, so
+  # unit/env changes would not take effect until the next repo change or reboot.
+  # Restart whenever the unit file changes.
+  service app_name do
+    action [:enable, :start]
+    subscribes :restart, "systemd_unit[#{app_name}.service]", :delayed
   end
 end
diff --git a/site-cookbooks/kredits-github/recipes/default.rb b/site-cookbooks/kredits-github/recipes/default.rb
index 5316e44..e74a507 100644
--- a/site-cookbooks/kredits-github/recipes/default.rb
+++ b/site-cookbooks/kredits-github/recipes/default.rb
@@ -32,7 +32,7 @@ git app_path do
   group deploy_group
   repository "https://github.com/67P/#{app_name}.git"
   revision   node[app_name]['revision']
-  notifies :restart, "systemd_unit[#{app_name}.service]", :delayed
+  notifies :restart, "service[#{app_name}]", :delayed
 end
 
 execute "npm install" do
@@ -54,6 +54,10 @@ service_env = {
   # Bind on all interfaces so the openresty reverse proxy (draco/fornax) can
   # reach the app over ZeroTier; port 3000 is firewalled to 10.1.1.0/24 below.
   "HOST" => '0.0.0.0',
+  # Probot 14 changed its default webhook path from "/" (Probot 7) to
+  # "/api/github/webhooks". The GitHub App is still configured to POST to
+  # "https://kredits-github.kosmos.org/", so keep serving there.
+  "WEBHOOK_PATH" => '/',
   "APP_ID" => credentials["app_id"],
   "PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem",
   "WEBHOOK_SECRET" => credentials["webhook_secret"]
@@ -80,7 +84,15 @@ systemd_unit "#{app_name}.service" do
   })
   verify false
   triggers_reload true
-  action [:create, :enable, :start]
+  action [:create, :enable]
+end
+
+# `systemd_unit` only reloads the daemon and never restarts a running unit, so
+# unit/env changes would not take effect until the next repo change or reboot.
+# Restart whenever the unit file changes.
+service app_name do
+  action [:enable, :start]
+  subscribes :restart, "systemd_unit[#{app_name}.service]", :delayed
 end
 
 unless node.chef_environment == "development"