tegwick
2f8387cc2f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
52 lines
2.8 KiB
Markdown
52 lines
2.8 KiB
Markdown
# Core Hub Forgejo source-read token
|
|
|
|
Date: 2026-10-03
|
|
Catalog: `core-hub-forgejo-source-read` (status `active`, `exec_capable: false`, `resolvable: false`)
|
|
Owner: `railiance-platform` (OpenBao and credential lifecycle)
|
|
|
|
This lane carries the dedicated Forgejo PAT that the Core Hub repo-manager
|
|
publisher (`rapp-core-hub`, deployable `repository-classification-publisher`)
|
|
uses to read private sources of the repository registry. The Forgejo identity
|
|
`core-hub-source` is restricted to organization-wide repository-code read in org
|
|
`coulomb`, and the PAT scope is exactly `read:repository`. It has no repository
|
|
write, package, organization administration, instance administration, Actions,
|
|
cluster, or deployment authority.
|
|
|
|
The authoritative lifecycle and evidence record is
|
|
`railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml`
|
|
(design: `railiance-platform/docs/credential-lane-designs/core-hub-forgejo-source-read.md`).
|
|
It is distinct from `policy-nexus-forgejo-source-read` (CCR-2026-0014); neither
|
|
identity nor token is reused across the two lanes.
|
|
|
|
## Owner-confirmed lane
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| OpenBao path | `platform/workloads/core-hub/forgejo-source-read` |
|
|
| Fields | `FORGEJO_SOURCE_TOKEN`, `API_USER`, `API_BASE_URL`, `TOKEN_SCOPES`, `GENERATED_AT` |
|
|
| Read policy | `workload-kv-read-core-hub-forgejo-source` |
|
|
| Auth | Kubernetes auth role `external-secrets-core-hub-forgejo-source` (bound to `external-secrets/external-secrets`) |
|
|
| Delivery | ClusterSecretStore `openbao-core-hub-forgejo-source` → ExternalSecret `core-hub/repo-manager-forgejo-source` → Secret key `token` |
|
|
| Forgejo identity | `core-hub-source` |
|
|
| Forgejo team | `core-hub-source-readers` |
|
|
|
|
## Worker checklist
|
|
|
|
1. There is no operator or agent fetch lane. External Secrets is the only reader,
|
|
so `warden access core-hub-forgejo-source-read --fetch/--exec` is not offered
|
|
and the fetch-policy pin does not list this lane. Do not request one; if a
|
|
legitimate operator read need appears, it goes through a new CCR first.
|
|
|
|
2. Check delivery health without reading values: ExternalSecret
|
|
`core-hub/repo-manager-forgejo-source` Ready, and `make verify-publisher` in
|
|
`rapp-core-hub`. Verify OpenBao allow/deny with `bao token capabilities`, never
|
|
`bao kv get` (see `catalog-lane-promotion.md`).
|
|
|
|
3. For rotation (every 180 days or on owner change), deactivation, or compromise,
|
|
follow the CCR-2026-0031 lifecycle; `warden rotate-guide core-hub-forgejo-source-read`
|
|
prints the rotation steps. A replacement is not active until `make
|
|
verify-publisher` passes; revoke the predecessor afterward.
|
|
|
|
4. Never place the value in argv, chat, Git, State Hub, logs, or a persistent
|
|
temporary file. Never substitute the Forgejo admin PAT, a personal token, or
|
|
the policy-nexus-source token.
|