Cut git-credential-forgejo-ssm.sh from coily to ward-kdl ops aws #255

New issue

Closed

opened 2026-06-18 09:10:13 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-06-18 09:10:13 +00:00

Member

What

Repoint scripts/git-credential-forgejo-ssm.sh from coily to ward-kdl for fetching the Forgejo API token.

Current (line 28):

token="$(coily ops aws ssm get-parameter ...)"

Target:

token="$(ward-kdl ops aws ssm get-parameter ...)"

ward-kdl ops aws ships in the released binary (v0.79.0) and covers ssm, so the capability is ready. This is a consumer cutover, not new work.

Why

This is a blocker for uninstalling coily. The credential helper is the only thing standing between git push to forgejo.coilysiren.me and a working auth flow. While the helper still calls coily ops aws ssm, removing coily breaks canonical Forgejo pushes.

Note the helper runs under git's minimal env (see the comment at the top of the file about coily/aws not being on PATH), so the cutover needs to confirm ward-kdl resolves under that same minimal env, not just an interactive shell.

Acceptance

scripts/git-credential-forgejo-ssm.sh calls ward-kdl ops aws ssm get-parameter, no coily reference left in the file.
A real git push to forgejo.coilysiren.me succeeds with the new helper.
Confirmed working from git's minimal-env invocation, not only an interactive shell.

Context

Part of the broader coily to ward/ward-kdl cutover. Capability status as of filing:

ssm/aws, tailscale, kubectl, forgejo, trello live in ward-kdl ops.
gcloud and flyctl are not load-bearing, dropping.
general-use docker is going away.
gaming (kai-server game servers) has no successor yet and is the one remaining capability gap, tracked separately.
The four .claude/lockdown-deny.sh files still exec coily hook pre-tool-use. Regenerating them to ward is a ward setup / CI step, not part of this issue.

## What Repoint `scripts/git-credential-forgejo-ssm.sh` from coily to ward-kdl for fetching the Forgejo API token. Current (line 28): ```sh token="$(coily ops aws ssm get-parameter ...)" ``` Target: ```sh token="$(ward-kdl ops aws ssm get-parameter ...)" ``` `ward-kdl ops aws` ships in the released binary (v0.79.0) and covers ssm, so the capability is ready. This is a consumer cutover, not new work. ## Why This is a blocker for uninstalling coily. The credential helper is the only thing standing between `git push` to forgejo.coilysiren.me and a working auth flow. While the helper still calls `coily ops aws ssm`, removing coily breaks canonical Forgejo pushes. Note the helper runs under git's minimal env (see the comment at the top of the file about coily/aws not being on PATH), so the cutover needs to confirm `ward-kdl` resolves under that same minimal env, not just an interactive shell. ## Acceptance - `scripts/git-credential-forgejo-ssm.sh` calls `ward-kdl ops aws ssm get-parameter`, no coily reference left in the file. - A real `git push` to forgejo.coilysiren.me succeeds with the new helper. - Confirmed working from git's minimal-env invocation, not only an interactive shell. ## Context Part of the broader coily to ward/ward-kdl cutover. Capability status as of filing: - ssm/aws, tailscale, kubectl, forgejo, trello live in `ward-kdl ops`. - gcloud and flyctl are not load-bearing, dropping. - general-use docker is going away. - gaming (kai-server game servers) has no successor yet and is the one remaining capability gap, tracked separately. - The four `.claude/lockdown-deny.sh` files still `exec coily hook pre-tool-use`. Regenerating them to ward is a `ward setup` / CI step, not part of this issue.

coilyco-ops commented

2026-06-18 09:17:31 +00:00

Author

Member

🔒 Reserved by ward agent claude — container ward-agentic-os-issue-255-claude-0c5b4aca on host kais-macbook-pro.local is carrying this issue (reserved 2026-06-18T09:17:30Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent claude` — container `ward-agentic-os-issue-255-claude-0c5b4aca` on host `kais-macbook-pro.local` is carrying this issue (reserved 2026-06-18T09:17:30Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilyco-ops referenced this issue

2026-06-18 09:17:53 +00:00

Scrub coily references as part of coily retirement #256