Opt-in BYO github.com PAT for Renovate (higher rate limits + changelogs)

supernaut kommenterad

2026-07-10 11:38:27 +00:00

Ägare

Opt-in enhancement: Renovate tenants may supply their own scopeless/public-read github.com PAT (encrypted, per-org or per-repo) to get higher github.com rate limits and changelog enrichment, in the existing shared Renovate process.

GitHub contact is accepted as part of using Renovate (documented, not gated); a scopeless token is low-value, so no isolation/egress work is needed. Private-dependency support is a separate future epic. (Design + implementation plan tracked internally.)

Horizon: Later.

Tasks

gitborg/gitborg-infra#56 — Renovate BYO: spike — verify self-hosted encryption mechanics
gitborg/gitborg-infra#57 — Renovate BYO: provision operator keypair + Vault secret + env injection
gitborg/gitborg-infra#58 — Renovate BYO: enable decryption + inheritConfig in config.js
gitborg/gitborg-web#39 — Renovate BYO: first-party CSP-locked encrypt page
gitborg/gitborg-docs#14 — Renovate BYO: ADR 0026 (tenant BYO github.com PAT)
gitborg/gitborg-web#40 — Renovate BYO: tenant KB guide + FAQ (sv/en)
gitborg/gitborg-infra#59 — Renovate BYO: runbook — encryption key management + rotation
gitborg/gitborg-infra#60 — Renovate BYO: rollout — apply + tenant-zero dogfood + Loki secret check

Opt-in enhancement: Renovate tenants may supply their own **scopeless/public-read** github.com PAT (encrypted, per-org or per-repo) to get higher github.com rate limits and changelog enrichment, in the existing shared Renovate process. GitHub contact is accepted as part of using Renovate (documented, not gated); a scopeless token is low-value, so no isolation/egress work is needed. Private-dependency support is a separate future epic. (Design + implementation plan tracked internally.) **Horizon:** Later. ### Tasks - [ ] gitborg/gitborg-infra#56 — Renovate BYO: spike — verify self-hosted encryption mechanics - [ ] gitborg/gitborg-infra#57 — Renovate BYO: provision operator keypair + Vault secret + env injection - [ ] gitborg/gitborg-infra#58 — Renovate BYO: enable decryption + inheritConfig in config.js - [ ] gitborg/gitborg-web#39 — Renovate BYO: first-party CSP-locked encrypt page - [ ] gitborg/gitborg-docs#14 — Renovate BYO: ADR 0026 (tenant BYO github.com PAT) - [ ] gitborg/gitborg-web#40 — Renovate BYO: tenant KB guide + FAQ (sv/en) - [ ] gitborg/gitborg-infra#59 — Renovate BYO: runbook — encryption key management + rotation - [ ] gitborg/gitborg-infra#60 — Renovate BYO: rollout — apply + tenant-zero dogfood + Loki secret check

supernaut lade till etiketterna

type

epic

area/ci

2026-07-10 11:38:27 +00:00

supernaut refererade till detta ärende från bitborg/bitborg-infra

2026-07-10 11:38:27 +00:00

Renovate BYO: spike — verify self-hosted encryption mechanics #56

supernaut refererade till detta ärende från bitborg/bitborg-infra

2026-07-10 11:38:27 +00:00

Renovate BYO: provision operator keypair + Vault secret + env injection #57

supernaut refererade till detta ärende från bitborg/bitborg-infra