From d3377fa4a709f5b7035cd1d6979b9df427dfb75c Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 3 Oct 2026 10:11:38 +0200
Subject: [PATCH] CCR-2026-0031: core-hub Forgejo source store and
 ExternalSecret, applied on railiance01

Server dry-run then apply of only the two new objects. Store Ready=True;
ExternalSecret core-hub/repo-manager-forgejo-source Ready=True SecretSynced
(status conditions only, no value read).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
---
 .../core-hub.externalsecrets.yaml             | 24 ++++++++++++++++
 ...hub-forgejo-source.clustersecretstore.yaml | 28 +++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 argocd/platform-addons/openbao-secretstore/openbao-core-hub-forgejo-source.clustersecretstore.yaml

diff --git a/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml b/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml
index 8a4ecdc..0de2b82 100644
--- a/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml
+++ b/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml
@@ -109,3 +109,27 @@ spec:
   dataFrom:
     - extract:
         key: creds/hub-core-migration
+---
+# CCR-2026-0031: repo-manager publisher private-source read token.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: repo-manager-forgejo-source
+  namespace: core-hub
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-core-hub-forgejo-source
+  target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
+    name: repo-manager-forgejo-source
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: token
+      remoteRef:
+        key: workloads/core-hub/forgejo-source-read
+        property: FORGEJO_SOURCE_TOKEN
diff --git a/argocd/platform-addons/openbao-secretstore/openbao-core-hub-forgejo-source.clustersecretstore.yaml b/argocd/platform-addons/openbao-secretstore/openbao-core-hub-forgejo-source.clustersecretstore.yaml
new file mode 100644
index 0000000..5a001f6
--- /dev/null
+++ b/argocd/platform-addons/openbao-secretstore/openbao-core-hub-forgejo-source.clustersecretstore.yaml
@@ -0,0 +1,28 @@
+# CCR-2026-0031 (approved and bound 2026-10-03; bootstrap evidence in the CCR).
+# Railiance01-local OpenBao Kubernetes-auth store for the Core Hub repo-manager
+# publisher's private-source read token. Namespace-limited to core-hub.
+# Applied on railiance01 with server dry-run first, like openbao-core-hub-runtime.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-core-hub-forgejo-source
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+    app.kubernetes.io/name: core-hub
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-core-hub-forgejo-source
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+    - namespaces:
+        - core-hub