secrets-engine/catalog/example-build-test-token.yaml

# Example BUILD-stage lane. Demonstrates that build entries can be looser:
# generated test values are allowed and no production decision is required.
id: example-build-test-token
org: coulomb
repo: platform-ci
stage: build
description: >-
  Throwaway generated credential for build-stage integration tests. May be
  generated locally; must never be reused in test or prod.

mount: secret
path: build/example/test-token

fields:
  - api_token

consumers:
  - name: build-runner
    auth: approle
    claim: "role:build-runner"
    purpose: "exercise build-stage integration tests"

delivery_modes:
  - exec-env
  - read-check

# Build stage permits bootstrap-only / generated values without a prod decision.
approval:
  model: bootstrap-only
  notes: "Build stage: generated test secret, no production decision required."

verification:
  positive: "build-runner token can read the generated value"
  negative: "prod consumers cannot read build paths"

rotation:
  expectation: "regenerate per run"
  ttl: "1h"

deactivation:
  expectation: "delete on build teardown"

audit:
  evidence: "actor, path, timestamp, result — no secret value"