Adopt Forgejo 16 Authorized Integrations for automation identity #622

New issue

Open

opened 2026-07-24 06:20:49 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-24 06:20:49 +00:00

Member

Blocked by coilyco-flight-deck/infrastructure#620.

Goal

Infrastructure adopts Forgejo 16 Authorized Integrations so Actions and automation can exchange a locally authorized identity for short-lived JWT access to the API, Git, and package services.

Work

Infrastructure inventories every Forgejo token family and consumer, including operations API access, read-only access, and package or OCI registry access.
Infrastructure defines one integration per bounded use case instead of one broad replacement credential.
Each integration restricts the source repository, workflow, ref, event, and capabilities where Forgejo supports those constraints.
Infrastructure validates API, Git, package, and OCI flows with the minimum required scopes.
Infrastructure migrates one low-risk consumer as a canary before broader rollout.
Infrastructure preserves bot attribution and records how operators identify integration-authenticated activity.
Infrastructure updates credential provisioning, SSM inventory, rotation, and recovery documentation.
Infrastructure retains the old credential until the operator proves the replacement and rollback path.
The operator rotates or deletes a static credential only after every recorded consumer has migrated.

Done

The canary obtains a short-lived credential without storing a long-lived Forgejo secret in its workflow.
Forgejo denies a token outside its configured repository, workflow, ref, event, or capability boundary.
Infrastructure documents issuance, expiry, audit, revocation, and emergency rollback.
Infrastructure tracks each remaining static token to an explicit migration or justified exception.

Blocked by coilyco-flight-deck/infrastructure#620. ## Goal Infrastructure adopts Forgejo 16 Authorized Integrations so Actions and automation can exchange a locally authorized identity for short-lived JWT access to the API, Git, and package services. ## Work * Infrastructure inventories every Forgejo token family and consumer, including operations API access, read-only access, and package or OCI registry access. * Infrastructure defines one integration per bounded use case instead of one broad replacement credential. * Each integration restricts the source repository, workflow, ref, event, and capabilities where Forgejo supports those constraints. * Infrastructure validates API, Git, package, and OCI flows with the minimum required scopes. * Infrastructure migrates one low-risk consumer as a canary before broader rollout. * Infrastructure preserves bot attribution and records how operators identify integration-authenticated activity. * Infrastructure updates credential provisioning, SSM inventory, rotation, and recovery documentation. * Infrastructure retains the old credential until the operator proves the replacement and rollback path. * The operator rotates or deletes a static credential only after every recorded consumer has migrated. ## Done * The canary obtains a short-lived credential without storing a long-lived Forgejo secret in its workflow. * Forgejo denies a token outside its configured repository, workflow, ref, event, or capability boundary. * Infrastructure documents issuance, expiry, audit, revocation, and emergency rollback. * Infrastructure tracks each remaining static token to an explicit migration or justified exception.

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-29 03:46:26 +00:00

coilyco-ops added

priority

and removed

priority

labels

2026-08-05 10:26:01 +00:00