security_case:
  case: forgejo-netkingdom-oidc
  type: oidc-browser-relying-party@1.1
  render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a
  acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
    type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
  accepted_at: '2026-10-08'
  accepted_by:
  - owner
  - founder
removes_exactly:
- kind: catalog_entry
  name: forgejo-keycape-client
- kind: openbao_role
  name: external-secrets-keycape-forgejo
- kind: openbao_policy
  name: workload-kv-read-keycape-forgejo-forgejo
- kind: openbao_policy
  name: workload-kv-read-keycape-forgejo-eso
- kind: kv_path
  name: platform/workloads/keycape/forgejo
steps:
- remove the OIDC source for forgejo from forgejo (owner railiance-apps)
- keycape-client.py apply --operation remove for forgejo
- remove env KEYCAPE_FORGEJO_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed
- delete ExternalSecret sso/keycape-forgejo-client and its target
- 'covered by client-secret-path: one metadata delete, after deliver-secret is reversed'
- identity-provisioner revoke_service_groups inside the provisioner pod (attended, as ensure-groups) with the case's
  memberships; delete_if_empty only if no other case uses forge-admins,forge-coulomb-owners,forge-coulomb-readers
- delete metadata and all versions at platform/workloads/keycape/forgejo, after the ExternalSecret is gone (this
  also reverses mint-secret)
- delete Kubernetes-auth role external-secrets-keycape-forgejo
- delete policy workload-kv-read-keycape-forgejo-eso, after eso-role
- delete policy workload-kv-read-keycape-forgejo-forgejo
- remove catalog entry forgejo-keycape-client
note: Undo removes only what this case created; shared groups are revoked only if no other case uses them.