47 lines
2.1 KiB
YAML
47 lines
2.1 KiB
YAML
|
# Publication-scope policy — owned by the netkingdom security-infrastructure domain,
|
||
|
|
# enforced by secrets-engine.
|
||
|
|
#
|
||
|
|
# Binds npm package *publication scope* to package *maturity*, and GATES the
|
||
|
|
# graduated (relaxed) scoping behind netkingdom itself reaching production grade.
|
||
|
|
#
|
||
|
|
# Design intent (proves policy-bound secret handling):
|
||
|
|
# - A repo's maturity translates into the maturity tag of the package it ships
|
||
|
|
# (maturity-build / maturity-test / maturity-prod).
|
||
|
|
# - Each maturity tag is restricted by the publication scope its token carries.
|
||
|
|
# - Low-stakes build artifacts may publish with a BROAD shared token; high-stakes
|
||
|
|
# production publishes require a TIGHT, repo-scoped token. Scope narrows as
|
||
|
|
# stakes rise.
|
||
|
|
# - The graduated table is DORMANT until netkingdom is production grade. While
|
||
|
|
# dormant, every lane clamps to the safest scope (repo) — fail-safe, never
|
||
|
|
# fail-open.
|
||
|
|
domain: netkingdom
|
||
|
|
policy: publication-scope
|
||
|
|
version: "0.1.0"
|
||
|
|
|
||
|
|
# netkingdom's own maturity. `production_grade` is derived: it is true only when
|
||
|
|
# this equals "maturity-prod". Today netkingdom is at maturity-build.
|
||
|
|
netkingdom_maturity: maturity-build
|
||
|
|
|
||
|
|
# When ACTIVE (production_grade == true): package maturity tag -> required scope.
|
||
|
|
maturity_scope:
|
||
|
|
maturity-build: gitea # gitea-wide publication rights
|
||
|
|
maturity-test: org # org-wide publication rights
|
||
|
|
maturity-prod: repo # repo-scoped publication rights
|
||
|
|
|
||
|
|
# Safe scope applied while DORMANT, and the floor that cannot be exceeded before
|
||
|
|
# netkingdom is production grade.
|
||
|
|
dormant_scope: repo
|
||
|
|
|
||
|
|
# Token env-var naming convention by effective scope. {ORG}/{SCOPE}/{REPO} are
|
||
|
|
# upper-cased, de-hyphenated forms of the lane's org / npm-scope / repo.
|
||
|
|
# org coulomb -> COULOMB
|
||
|
|
# scope @whynot -> WHYNOT (npm scope = "project"; defined, NOT used by policy)
|
||
|
|
# repo whynot-design -> WHYNOTDESIGN
|
||
|
|
# The default repo-scope name is the bare NPM_AUTH_TOKEN; the explicit per-repo
|
||
|
|
# form (NPM_AUTH_{REPO}) is available when a lane overrides it.
|
||
|
|
token_env:
|
||
|
|
gitea: "NPM_AUTH_GITEA_TOKEN"
|
||
|
|
org: "NPM_AUTH_{ORG}_TOKEN"
|
||
|
|
scope: "NPM_AUTH_{SCOPE}_TOKEN"
|
||
|
|
repo: "NPM_AUTH_TOKEN"
|