tap-writer ExternalSecret: repoint tap-token to /forgejo/ci-release-token #240

New issue

Closed

opened 2026-06-06 04:55:38 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-06 04:55:38 +00:00

Owner

The tap-writer runner's ExternalSecret (deploy/forgejo-runner-tap-writer.yml) referenced /forgejo/tap-bump-token, which was never provisioned, so the secret sat in SecretSyncedError and the runner could not start.

A suitable token already exists: /forgejo/ci-release-token (write:repository), minted out-of-band a few days ago. Repoint the tap-token remoteRef.key to it rather than minting the redundant dedicated token from #195's provision script.

Trade-off accepted: ci-release-token is broader (write:repository to all repos) than #195's intended least-privilege tap-only token. Chosen for expedience; revisit if blast radius matters.

Discovered while triaging the runner-tier outage (coilysiren/inbox#65).

The tap-writer runner's ExternalSecret (`deploy/forgejo-runner-tap-writer.yml`) referenced `/forgejo/tap-bump-token`, which was never provisioned, so the secret sat in `SecretSyncedError` and the runner could not start. A suitable token already exists: `/forgejo/ci-release-token` (`write:repository`), minted out-of-band a few days ago. Repoint the `tap-token` `remoteRef.key` to it rather than minting the redundant dedicated token from #195's provision script. Trade-off accepted: `ci-release-token` is broader (`write:repository` to all repos) than #195's intended least-privilege tap-only token. Chosen for expedience; revisit if blast radius matters. Discovered while triaging the runner-tier outage (coilysiren/inbox#65).

coilysiren referenced this issue from a commit

2026-06-06 04:57:02 +00:00

fix(forgejo): repoint tap-writer secret to /forgejo/ci-release-token

coilysiren closed this issue

2026-06-06 04:57:02 +00:00