13 lines
468 B
HCL
13 lines
468 B
HCL
|
# Least-privilege read policy for the Forgejo operator/admin API token (PAT).
|
||
|
|
#
|
||
|
|
# Grants read access to the site-admin PAT used by workstation and activity-core
|
||
|
|
# automation (package prune, org webhooks, operator bootstrap). Sibling to
|
||
|
|
# forgejo-mailer (SMTP); no cluster ESO delivery in phase 1.
|
||
|
|
|
||
|
|
path "platform/data/workloads/forgejo/forgejo-admin" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "platform/metadata/workloads/forgejo/forgejo-admin" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|