# Least-privilege read policy for the Forgejo operator/admin API token (PAT).
#
# Grants read access to the site-admin PAT used by workstation and activity-core
# automation (package prune, org webhooks, operator bootstrap). Sibling to
# forgejo-mailer (SMTP).
#
# Cluster delivery (ACTIVITY-WP-0023-T05): attached to the
# openbao-activity-core ESO token so ExternalSecret actcore-forgejo-admin can
# merge FORGEJO_TOKEN into actcore-runtime-secret.

path "platform/data/workloads/forgejo/forgejo-admin" {
  capabilities = ["read"]
}

path "platform/metadata/workloads/forgejo/forgejo-admin" {
  capabilities = ["read"]
}