docs(runbook): mint service-account PATs via an admin bot, not a personal account #141

Sammanfogat

supernaut sammanfogade 1 incheckning från docs/admin-bot-pat-policy in i main

2026-07-19 12:16:29 +00:00

supernaut kommenterad

2026-07-19 12:13:18 +00:00

Ägare

Codifies the policy set while wiring up the CI registry-read token (#137): the admin token API's § Rotate a service-account PAT said to authenticate with "e.g. your own" admin PAT.

Change: require a write:admin PAT from a dedicated admin bot (gitborg-reconciler / gitborg-runner-controller, from the vault) — never a human's personal admin token. Keeps admin automation attributable to a bot, avoids spreading a personal credential, and matches the Option-2 forgejo_service_accounts model. Also renames the example $YOUR_ADMIN_PAT → $ADMIN_BOT_PAT.

Docs-only; prettier + markdownlint clean. No CI/apply impact.

Codifies the policy set while wiring up the CI registry-read token (#137): the admin token API's § *Rotate a service-account PAT* said to authenticate with "*e.g. your own*" admin PAT. Change: require a `write:admin` PAT from a **dedicated admin bot** (`gitborg-reconciler` / `gitborg-runner-controller`, from the vault) — never a human's personal admin token. Keeps admin automation attributable to a bot, avoids spreading a personal credential, and matches the Option-2 `forgejo_service_accounts` model. Also renames the example `$YOUR_ADMIN_PAT` → `$ADMIN_BOT_PAT`. Docs-only; prettier + markdownlint clean. No CI/apply impact.

supernaut lade till 1 incheckning

2026-07-19 12:13:18 +00:00

docs(runbook): mint service-account PATs via an admin bot, not a personal account

ci / ci (pull_request) Successful in 13s

Detaljer

653fd34191

The § Rotate a service-account PAT procedure said to auth 'e.g. your own' admin
PAT. Codify the policy: use a write:admin PAT from a dedicated admin bot
(gitborg-reconciler / gitborg-runner-controller), never a human's personal token —
keeps admin automation attributable to a bot and matches the Option-2 service-
account model in group_vars.

supernaut sammanfogade incheckning eea9e91f19 till main

2026-07-19 12:16:29 +00:00

supernaut tog bort grenen docs/admin-bot-pat-policy

2026-07-19 12:16:29 +00:00

supernaut refererade denna ändringsförfrågan från en incheckning

2026-07-19 12:16:30 +00:00

docs(runbook): mint service-account PATs via an admin bot, not a personal account (#141)

supernaut refererade denna ändringsförfrågan från en incheckning

2026-08-03 09:41:34 +00:00

docs(runbook): mint service-account PATs via an admin bot, not a personal account (#141)

Logga in för att delta i denna konversation.

Inga granskare