feat(forgejo): promote runner-token fetch overlay

coilyco-ops commented

2026-07-14 19:05:29 +00:00

Owner

Replace the runner-token mint path with declarative fetch overlays and keep the scope router thin. This removes the raw curl surface from the guarded path while preserving the existing ward ops forgejo actions generate-runner-token entrypoint.

What changed: added the fetch overlay, the thin router, the Forgejo role bindings, and the supporting docs.
Why: runner-token minting should ride the specverb permission model instead of a hand-rolled curl bridge.
Tests: ward exec test -- tests/test_forgejo_runner_token.py tests/test_forgejo_actions_list_bridge.py tests/test_forgejo_actions_logs.py tests/test_release_actions.py.

closes #453
ward.workflow: pull-request-and-merge

Replace the runner-token mint path with declarative fetch overlays and keep the scope router thin. This removes the raw curl surface from the guarded path while preserving the existing `ward ops forgejo actions generate-runner-token` entrypoint. - What changed: added the fetch overlay, the thin router, the Forgejo role bindings, and the supporting docs. - Why: runner-token minting should ride the specverb permission model instead of a hand-rolled curl bridge. - Tests: `ward exec test -- tests/test_forgejo_runner_token.py tests/test_forgejo_actions_list_bridge.py tests/test_forgejo_actions_logs.py tests/test_release_actions.py`. closes #453 ward.workflow: pull-request-and-merge

coilyco-ops added 1 commit

2026-07-14 19:05:30 +00:00

feat(forgejo): add runner-token fetch overlay

ci / ward-doctor (pull_request) Failing after 39s

Details

ci / gate (pull_request) Failing after 4m15s

Details

ca3b059a85

closes #453

coilyco-ops added 1 commit

2026-07-14 19:27:20 +00:00

fix(forgejo): remove runner-token shell bridge

ci / ward-doctor (pull_request) Successful in 15s

Details

ci / gate (pull_request) Successful in 59s

Details

9f12c4033d

coilyco-ops referenced this pull request

2026-07-14 19:29:45 +00:00

Replace .ward/forgejo-runner-token.sh raw-curl exec-bridge with a first-class specverb fetch overlay (cli-guard#216) #453

coilyco-ops commented

2026-07-14 19:33:05 +00:00

Author

Owner

{
  "verdict": "pass",
  "summary": "The runner-token surface now routes through declarative fetch overlays, the raw shell bridge is removed, and the checked head SHA is green.",
  "evidence": [
    "ward doctor passes with WARD_CONFIG_REF=file://${PWD}/.ward",
    "Focused tests passed: tests/test_forgejo_runner_token.py, tests/test_forgejo_actions_list_bridge.py, tests/test_forgejo_actions_logs.py, tests/test_forgejo_actions_rerun.py",
    "CI run 1302 on head 9f12c4033db84b865e211231e43673bf689725b4 finished success"
  ],
  "risks": [
    "Full pre-commit could not be completed locally because the container overlay filesystem was full and the Go cache path was unavailable"
  ],
  "next_steps": [
    "Merge the PR via the director-completion path"
  ]
}

```json { "verdict": "pass", "summary": "The runner-token surface now routes through declarative fetch overlays, the raw shell bridge is removed, and the checked head SHA is green.", "evidence": [ "ward doctor passes with WARD_CONFIG_REF=file://${PWD}/.ward", "Focused tests passed: tests/test_forgejo_runner_token.py, tests/test_forgejo_actions_list_bridge.py, tests/test_forgejo_actions_logs.py, tests/test_forgejo_actions_rerun.py", "CI run 1302 on head 9f12c4033db84b865e211231e43673bf689725b4 finished success" ], "risks": [ "Full pre-commit could not be completed locally because the container overlay filesystem was full and the Go cache path was unavailable" ], "next_steps": [ "Merge the PR via the director-completion path" ] } ```

coilyco-ops referenced this pull request

2026-07-14 19:33:29 +00:00

Replace .ward/forgejo-runner-token.sh raw-curl exec-bridge with a first-class specverb fetch overlay (cli-guard#216) #453

coilyco-ops commented

2026-07-14 19:33:40 +00:00

Author

Owner

WARDED_WORKFLOW: #537

details

workflow: pull-request-and-merge; review summary: passed
head sha: 9f12c4033d
review gate intentionally skipped because the temporary ward default was pending brokered QA.

WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/pulls/537 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: passed head sha: 9f12c4033db84b865e211231e43673bf689725b4 review gate intentionally skipped because the temporary ward default was pending brokered QA. </details>

coilyco-ops referenced this pull request

2026-07-14 19:35:57 +00:00

Replace .ward/forgejo-runner-token.sh raw-curl exec-bridge with a first-class specverb fetch overlay (cli-guard#216) #453

coilyco-ops referenced this pull request

2026-07-14 19:40:20 +00:00

Replace .ward/forgejo-runner-token.sh raw-curl exec-bridge with a first-class specverb fetch overlay (cli-guard#216) #453

coilyco-ops merged commit a3133c6a0a into main

2026-07-14 19:40:42 +00:00

coilyco-ops deleted branch issue-453-pr

2026-07-14 19:40:42 +00:00

coilyco-ops referenced this pull request

2026-07-14 19:40:42 +00:00