From a7339fa60dc0fcf489811b4a32b785366d91e29c Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 19 Oct 2026 10:35:33 +0200
Subject: [PATCH] Declare approved Forgejo public PKCE development sign-in
 profile

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15302-b965-7d43-a9d8-42710914b24e
---
 .../client-profiles/forgejo-public-build.yaml     | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml

diff --git a/sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml b/sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml
new file mode 100644
index 0000000..4ffc903
--- /dev/null
+++ b/sso-mfa/k8s/keycape/client-profiles/forgejo-public-build.yaml
@@ -0,0 +1,15 @@
+# Temporary build profile; activation requires the exact CUST80-FORGEJO-PUBLIC-BUILD-20261018 approval.
+# The accepted confidential-client case remains the target; full acceptance is CUST-WP-0082-T20.
+clientId: forgejo
+displayName: Forgejo source forge
+redirectUris:
+- https://forgejo.coulomb.social/user/oauth2/netkingdom/callback
+allowedScopes:
+- openid
+- profile
+- email
+- groups
+grantTypes:
+- authorization_code
+clientType: public
+mfaRequired: true