feat: tap-writer runner + tap-bump token provisioning #195

Merged

coilysiren merged 1 commit from feat/tap-writer-runner into main

2026-06-04 05:31:31 +00:00

coilysiren commented

2026-06-04 01:04:52 +00:00

Owner

Stand up a dedicated, DinD-free Forgejo runner for cross-repo homebrew formula bumps.

Companion PR: coilyco-flight-deck/ward#47 - the ward release job that targets runs-on: tap-writer. Apply this runner (and provision the token) before merging that one.

What

deploy/forgejo-runner-tap-writer.yml - host-executor act_runner, label tap-writer, no DinD. Token from SSM /forgejo/tap-bump-token reaches git only via a credential helper (never job env / Actions secret).
scripts/provision-tap-bump-token.sh - mint a write:repository Forgejo token, store at SSM (no overwrite). Run on a machine with Forgejo + AWS creds + coily.
docs/FEATURES.md - runner entry.

Run order (on a cluster-access machine)

FORGEJO_USER=<u> FORGEJO_PASS=<p> ./scripts/provision-tap-bump-token.sh
sudo k3s kubectl apply -f deploy/forgejo-runner-tap-writer.yml
Confirm the runner registers tap-writer:host and picks up a job. If the image gates the host executor, fall back to a docker://node:20-bookworm label.
Merge the companion PR coilyco-flight-deck/ward#47.

closes #194

🤖 Generated with Claude Code

Stand up a dedicated, DinD-free Forgejo runner for cross-repo homebrew formula bumps. **Companion PR:** coilyco-flight-deck/ward#47 - the ward release job that targets `runs-on: tap-writer`. Apply this runner (and provision the token) before merging that one. ## What - `deploy/forgejo-runner-tap-writer.yml` - host-executor `act_runner`, label `tap-writer`, no DinD. Token from SSM `/forgejo/tap-bump-token` reaches git only via a credential helper (never job env / Actions secret). - `scripts/provision-tap-bump-token.sh` - mint a `write:repository` Forgejo token, store at SSM (no overwrite). Run on a machine with Forgejo + AWS creds + coily. - `docs/FEATURES.md` - runner entry. ## Run order (on a cluster-access machine) 1. `FORGEJO_USER=<u> FORGEJO_PASS=<p> ./scripts/provision-tap-bump-token.sh` 2. `sudo k3s kubectl apply -f deploy/forgejo-runner-tap-writer.yml` 3. Confirm the runner registers `tap-writer:host` and picks up a job. If the image gates the host executor, fall back to a `docker://node:20-bookworm` label. 4. Merge the companion PR coilyco-flight-deck/ward#47. closes #194 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilysiren added 1 commit

2026-06-04 01:04:52 +00:00

feat: add tap-writer runner and tap-bump token provisioning

CI / lint (pull_request) Has been cancelled

Details

TruffleHog / Scan for secrets (pull_request) Has been cancelled

Details

83f6f4abed

A lightweight, DinD-free Forgejo runner (label tap-writer, host executor)
dedicated to cross-repo formula bumps into the coilyco-flight-deck
homebrew tap(s). The write token lives in SSM /forgejo/tap-bump-token
and reaches git only through a credential helper - never a job env or a
Forgejo Actions secret. scripts/provision-tap-bump-token.sh mints the
write:repository token and stores it (no overwrite).

closes #194

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coilysiren referenced this pull request from a commit

2026-06-04 01:05:03 +00:00

ci: run tap bump on the dedicated tap-writer runner

coilysiren referenced this pull request from coilyco-flight-deck/ward

2026-06-04 01:05:13 +00:00

ci: run tap bump on the dedicated tap-writer runner #47

coilysiren referenced this pull request

2026-06-04 01:08:08 +00:00

Add tap-writer Forgejo runner + tap-bump token provisioning #194

coilysiren merged commit 8021622d39 into main

2026-06-04 05:31:31 +00:00

coilysiren referenced this pull request from a commit