361005cf0c
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
108 lines
4.2 KiB
YAML
108 lines
4.2 KiB
YAML
id: CCR-2026-0014
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: Policy Nexus Forgejo private-source read token lane
|
|
status: in_flight
|
|
created: '2026-08-31'
|
|
updated: '2026-08-31'
|
|
requester:
|
|
agent: codex
|
|
reason: >-
|
|
PNEX-WP-0004 makes scheduled Policy Nexus candidate builds fetch exact
|
|
archives from private owner repositories. Anonymous Forgejo API/archive
|
|
reads return 404, while the existing Forgejo admin PAT carries package,
|
|
repository-write, and admin authority that the publication workflow must
|
|
not receive.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-operator
|
|
- policy-nexus-owner
|
|
comments: []
|
|
in_flight:
|
|
missing_fields:
|
|
- openbao.policy_file
|
|
- openbao.auth
|
|
blocking_reason: >-
|
|
The platform owner must choose and verify the attended OpenBao-to-Forgejo
|
|
Actions secret-delivery path before policy/auth metadata is generated.
|
|
owner: railiance-platform
|
|
target:
|
|
domain: infotech
|
|
tenant: coulomb
|
|
workload: policy-nexus-actions
|
|
environment: production
|
|
purpose: >-
|
|
Hold a dedicated Forgejo PAT with read:repository only and deliver it as
|
|
the FORGEJO_SOURCE_TOKEN secret to the policy-nexus Actions workflow.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/policy-nexus/forgejo-source-read
|
|
fields:
|
|
- FORGEJO_SOURCE_TOKEN
|
|
- API_USER
|
|
- API_BASE_URL
|
|
- TOKEN_SCOPES
|
|
- GENERATED_AT
|
|
policy_name: workload-kv-read-policy-nexus-forgejo-source
|
|
access_frontdoor:
|
|
type: ops-warden
|
|
catalog_id: policy-nexus-forgejo-source-read
|
|
selector: policy nexus Forgejo private source repository read token Actions
|
|
readiness: pending-review
|
|
resolvable: false
|
|
delivery:
|
|
surface: forgejo-actions-secret
|
|
target: >-
|
|
Repository Actions secret FORGEJO_SOURCE_TOKEN on coulomb/policy-nexus.
|
|
Delivery is attended and must not expose the value in command output,
|
|
process arguments, Git, State Hub, or workflow logs.
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- The PAT scope is exactly read:repository; no package, repository-write,
|
|
organization-admin, user-write, cluster, or deployment authority.
|
|
- REGISTRY_TOKEN remains a separate package-write credential and is never
|
|
reused for source acquisition.
|
|
- The workflow binds the authorization header to
|
|
https://forgejo.coulomb.social and refuses cross-origin forwarding.
|
|
- The existing Forgejo admin PAT is not an acceptable fallback.
|
|
verification:
|
|
positive:
|
|
- >-
|
|
A scheduled or dispatched policy-nexus workflow resolves every declared
|
|
private repository revision and exact archive, then publishes a candidate.
|
|
- >-
|
|
The token metadata reports read:repository and no broader scopes without
|
|
printing the token value.
|
|
negative:
|
|
- The PAT cannot create, update, or delete repository content.
|
|
- The PAT cannot write packages or administer users, organizations, hooks,
|
|
runners, Actions secrets, or the Forgejo instance.
|
|
- A default or unrelated OpenBao identity cannot read the KV data path.
|
|
- Removing FORGEJO_SOURCE_TOKEN makes the workflow fail before source fetch.
|
|
activation_conditions:
|
|
- Platform operator and Policy Nexus owner approve this CCR.
|
|
- A dedicated service identity and read:repository-only PAT are created in
|
|
an attended Forgejo session.
|
|
- The OpenBao policy/auth path and non-secret metadata are reviewed before
|
|
apply.
|
|
- The PAT is transferred directly into OpenBao and the repository Actions
|
|
secret without logs, chat, Git, State Hub, or persistent temp files.
|
|
- Positive and negative scope tests and one workflow run are recorded.
|
|
lifecycle:
|
|
deactivate: >-
|
|
Remove the repository Actions secret, revoke the Forgejo PAT, disable the
|
|
OpenBao access path, and leave scheduled publication failing closed.
|
|
rotate: >-
|
|
Mint a replacement read:repository-only PAT, update OpenBao and the Actions
|
|
secret through attended custody, pass one candidate build, then revoke the
|
|
predecessor.
|
|
compromised: >-
|
|
Remove the Actions secret and revoke the PAT immediately, inspect private
|
|
repository read activity, rotate through the approved lane, and record a
|
|
bounded incident follow-up.
|
|
state_hub:
|
|
workplan_id: PNEX-WP-0004
|
|
task_id: PNEX-WP-0004-T03
|