coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/core-hub-forgejo-source-read.md
tegwick 2f8387cc2f CUST-WP-0075: catalog entry core-hub-forgejo-source-read (CCR-2026-0031) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
2026-10-03 12:55:08 +02:00

2.8 KiB
Raw Blame History

Core Hub Forgejo source-read token

Date: 2026-10-03 Catalog: core-hub-forgejo-source-read (status active, exec_capable: false, resolvable: false) Owner: railiance-platform (OpenBao and credential lifecycle)

This lane carries the dedicated Forgejo PAT that the Core Hub repo-manager publisher (rapp-core-hub, deployable repository-classification-publisher) uses to read private sources of the repository registry. The Forgejo identity core-hub-source is restricted to organization-wide repository-code read in org coulomb, and the PAT scope is exactly read:repository. It has no repository write, package, organization administration, instance administration, Actions, cluster, or deployment authority.

The authoritative lifecycle and evidence record is railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml (design: railiance-platform/docs/credential-lane-designs/core-hub-forgejo-source-read.md). It is distinct from policy-nexus-forgejo-source-read (CCR-2026-0014); neither identity nor token is reused across the two lanes.

Owner-confirmed lane

Field Value
OpenBao path platform/workloads/core-hub/forgejo-source-read
Fields FORGEJO_SOURCE_TOKEN, API_USER, API_BASE_URL, TOKEN_SCOPES, GENERATED_AT
Read policy workload-kv-read-core-hub-forgejo-source
Auth Kubernetes auth role external-secrets-core-hub-forgejo-source (bound to external-secrets/external-secrets)
Delivery ClusterSecretStore openbao-core-hub-forgejo-source → ExternalSecret core-hub/repo-manager-forgejo-source → Secret key token
Forgejo identity core-hub-source
Forgejo team core-hub-source-readers

Worker checklist

  1. There is no operator or agent fetch lane. External Secrets is the only reader, so warden access core-hub-forgejo-source-read --fetch/--exec is not offered and the fetch-policy pin does not list this lane. Do not request one; if a legitimate operator read need appears, it goes through a new CCR first.

  2. Check delivery health without reading values: ExternalSecret core-hub/repo-manager-forgejo-source Ready, and make verify-publisher in rapp-core-hub. Verify OpenBao allow/deny with bao token capabilities, never bao kv get (see catalog-lane-promotion.md).

  3. For rotation (every 180 days or on owner change), deactivation, or compromise, follow the CCR-2026-0031 lifecycle; warden rotate-guide core-hub-forgejo-source-read prints the rotation steps. A replacement is not active until make verify-publisher passes; revoke the predecessor afterward.

  4. Never place the value in argv, chat, Git, State Hub, logs, or a persistent temporary file. Never substitute the Forgejo admin PAT, a personal token, or the policy-nexus-source token.