Private github.com dependencies for Renovate via per-repo CI isolation #13

Nytt ärende

Öppen

öppnade 2026-07-10 11:38:27 +00:00 av supernaut · 0 kommentarer

supernaut kommenterad

2026-07-10 11:38:27 +00:00

Ägare

Deferred follow-on to the BYO github.com PAT epic. Supporting private github.com dependencies means custodying high-value tokens, which the shared Renovate process cannot do safely (a tenant repo can execute code in-process and exfiltrate the operator key). Requires the isolation model: Renovate-in-CI, one repo per ephemeral OpenStack runner (ADR 0021), tenant PAT as a repo-scoped Forgejo Actions secret, per-job default-deny egress.

Horizon: Later (parked until private-dep demand exists).

Deferred follow-on to the BYO github.com PAT epic. Supporting **private** github.com dependencies means custodying high-value tokens, which the shared Renovate process cannot do safely (a tenant repo can execute code in-process and exfiltrate the operator key). Requires the isolation model: Renovate-in-CI, one repo per ephemeral OpenStack runner (ADR 0021), tenant PAT as a **repo-scoped Forgejo Actions secret**, per-job default-deny egress. **Horizon:** Later (parked until private-dep demand exists).

supernaut lade till etiketterna

2026-07-10 11:38:27 +00:00

supernaut lade till detta till projektet Bitborg Roadmap

2026-07-10 11:42:02 +00:00

Logga in för att delta i denna konversation.