139 lines
4.8 KiB
Markdown
139 lines
4.8 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0013
|
|
type: workplan
|
|
title: "Forgejo admin PAT OpenBao consumer cutover"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-07-25"
|
|
updated: "2026-07-26"
|
|
related_repos:
|
|
- activity-core
|
|
- ops-warden
|
|
state_hub_workstream_id: "38fa254d-cd56-498a-8385-f9673ec005ac"
|
|
---
|
|
|
|
# RAILIANCE-WP-0013 - Forgejo admin PAT OpenBao consumer cutover
|
|
|
|
## Goal
|
|
|
|
Cut the Forgejo package-prune consumer over from workstation-local PAT handling
|
|
to the approved OpenBao lane recorded in `CCR-2026-0006`.
|
|
|
|
The immediate trigger is the unread `ops-warden` coordination message from
|
|
July 12, 2026 requesting that `tools/cmd/forgejo-package-prune` stop depending
|
|
on `/tmp/forgejo-tegwick-api-token` as the steady-state fallback when
|
|
`FORGEJO_ADMIN_TOKEN` is unset.
|
|
|
|
## Boundaries
|
|
|
|
This workplan may:
|
|
|
|
- update the Forgejo package-prune token resolution path
|
|
- update package-prune runbooks and operator handoff docs
|
|
- coordinate the consumer contract with the approved credential lane
|
|
|
|
It must not:
|
|
|
|
- move platform secret-governance ownership out of `railiance-platform`
|
|
- paste token values into Git, State Hub, chat, shell history, or logs
|
|
- break the existing prune workflow before the replacement path is verified
|
|
|
|
## T01 - Inventory current consumer and fallback paths
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0013-T01
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "68131f3b-cb97-4aa9-abbb-cddb1e395703"
|
|
```
|
|
|
|
Record where the current Forgejo admin PAT is consumed and documented, including:
|
|
|
|
- `scripts/forgejo_package_prune.py`
|
|
- `tools/cmd/forgejo-package-prune`
|
|
- `docs/forgejo-package-prune.md`
|
|
- any activity-core automation handoff that still assumes workstation file drops
|
|
|
|
Done when the remaining `/tmp/forgejo-tegwick-api-token` dependency surface is explicit.
|
|
|
|
2026-07-26: Confirmed the remaining legacy surface in
|
|
`scripts/forgejo_package_prune.py` and `docs/forgejo-package-prune.md`; the
|
|
approved lane reference already lived in `CCR-2026-0006` and
|
|
`docs/workload-kv-access-lanes.md`.
|
|
|
|
## T02 - Implement the approved non-file fallback path
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0013-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "f67a58e5-d780-4226-97a8-4c669b47e4a4"
|
|
```
|
|
|
|
Change the package-prune consumer so that, when `FORGEJO_TOKEN` and
|
|
`FORGEJO_ADMIN_TOKEN` are unset, it uses the approved OpenBao-backed access
|
|
path rather than the workstation file as the steady-state fallback.
|
|
|
|
Done when the token loader prefers the approved lane and the old file drop is
|
|
demoted to break-glass or removed if no longer needed.
|
|
|
|
2026-07-26: `scripts/forgejo_package_prune.py` now resolves
|
|
`platform/workloads/forgejo/forgejo-admin` field `API_TOKEN` through `bao kv get`
|
|
when `FORGEJO_TOKEN` and `FORGEJO_ADMIN_TOKEN` are unset. Explicit
|
|
`FORGEJO_TOKEN_FILE` / `FORGEJO_ADMIN_TOKEN_FILE` remain supported as attended
|
|
break-glass handoffs, and `/tmp/forgejo-tegwick-api-token` only works when
|
|
`FORGEJO_ALLOW_LEGACY_FILE_FALLBACK=1` is set.
|
|
|
|
## T03 - Update operator guidance and lane references
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0013-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "ed5f791c-5beb-43bd-844b-4188b604bc3f"
|
|
```
|
|
|
|
Refresh the operator docs so they align with `CCR-2026-0006`, the routing
|
|
catalog, and the final consumer behavior.
|
|
|
|
Done when the package-prune runbook no longer presents the workstation file as
|
|
the primary path.
|
|
|
|
2026-07-26: Updated `docs/forgejo-package-prune.md` so the primary operator path
|
|
is `warden plan` + `bao login` against `forgejo-admin-workload-kv-read`; the
|
|
retired `/tmp` drop is now documented as legacy unwind only, with explicit
|
|
break-glass env/file overrides kept for attended sessions.
|
|
|
|
## T04 - Verify prune workflow and close the inbox request
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0013-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "1fc2af0f-b4ff-4694-b072-23af0254377e"
|
|
```
|
|
|
|
Blocked on T01-T03.
|
|
|
|
Verify the consumer cutover with a non-secret dry-run and close the originating
|
|
coordination loop from `ops-warden`.
|
|
|
|
Done when the replacement path is verified and the old unread message has a
|
|
clear repo-local follow-up trail.
|
|
|
|
2026-07-26: Added focused token-resolution coverage in
|
|
`tests/test_forgejo_package_prune.py` for direct env, explicit file overrides,
|
|
OpenBao fallback, legacy-file gating, and operator-facing failure text. This
|
|
closes the `ops-warden` coordination loop triggered by message
|
|
`5be8e500-ebf5-405b-9aec-c902353ae719`; the repo-local follow-up trail is now in
|
|
this workplan, the prune runbook, and the loader implementation.
|
|
|
|
## Acceptance
|
|
|
|
- [x] `forgejo-package-prune` no longer defaults to `/tmp/forgejo-tegwick-api-token`
|
|
- [x] The steady-state fallback path reads the approved OpenBao lane from `CCR-2026-0006`
|
|
- [x] Operator docs present OpenBao / `warden` routing as the primary path
|
|
- [x] Repo-local tests cover the new token-resolution behavior without reading secret values
|