jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

feat(ci): P5 - sync CI secrets from the vault; drop BW_SESSION #43

Closed
jfraeys wants to merge 0 commits from jfraeys/feat/p5-ci-secret-sync into main
pull from: jfraeys/feat/p5-ci-secret-sync
merge into: jfraeys:main
Conversation 0 Commits - Files changed -
jfraeys commented 2026-10-10 10:48:47 -04:00
Owner
Copy link

P5 of the secrets plan.

  • .forgejo/ci-secrets.yml: Forgejo repo secret -> vault key (the vault stays authoritative).
  • scripts/sync-ci-secrets.py: default is a read-only check; --apply creates missing secrets, --apply --force rewrites, --only NAME scopes. Names and statuses only, nonzero exit on any write or presence failure. Tested against the real repo with a throwaway non-secret value (written, bad vault key reported, rerun skipped, --force rewrote, deleted after).
  • BW_SESSION removed from staging-validate and staging-reboot-check (the P0 trace showed CI never needed it).
  • README + docs/runbooks/ci-secrets-restore.md.

Current state: OBJECT_STORAGE_* present; LINODE_TOKEN, CLOUDFLARE_API_TOKEN, FORGEJO_ADMIN_TOKEN are still missing as repo secrets (the workflows need them). This PR does not write them: their privileges are unknown (manifest) and CI would get full-scope provider tokens. Decision needed, see PR comments / chat.

Not verified: that removing BW_SESSION leaves staging-validate green in CI (it runs on push to main, not on PRs).

🤖 Generated with Claude Code

P5 of the secrets plan. - `.forgejo/ci-secrets.yml`: Forgejo repo secret -> vault key (the vault stays authoritative). - `scripts/sync-ci-secrets.py`: default is a read-only check; `--apply` creates missing secrets, `--apply --force` rewrites, `--only NAME` scopes. Names and statuses only, nonzero exit on any write or presence failure. Tested against the real repo with a throwaway non-secret value (written, bad vault key reported, rerun skipped, `--force` rewrote, deleted after). - `BW_SESSION` removed from staging-validate and staging-reboot-check (the P0 trace showed CI never needed it). - README + `docs/runbooks/ci-secrets-restore.md`. **Current state:** `OBJECT_STORAGE_*` present; `LINODE_TOKEN`, `CLOUDFLARE_API_TOKEN`, `FORGEJO_ADMIN_TOKEN` are still missing as repo secrets (the workflows need them). This PR does not write them: their privileges are unknown (manifest) and CI would get full-scope provider tokens. Decision needed, see PR comments / chat. Not verified: that removing BW_SESSION leaves staging-validate green in CI (it runs on push to main, not on PRs). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat(ci): P5 - declare CI secrets as vault replicas and sync them; drop BW_SESSION
All checks were successful
Lint / lint (pull_request) Successful in 1m8s
Details
dd10a6eb32
 
.forgejo/ci-secrets.yml maps each Forgejo repo secret to the vault key it
replicates; scripts/sync-ci-secrets.py checks (default, read-only) or writes
them (--apply, --force, --only), reports names and statuses only and exits
nonzero on any failure. Tested against the real repo with a throwaway
non-secret secret (good key written, missing vault key reported, rerun skipped,
--force rewrote, deleted afterwards). BW_SESSION is removed from the two
workflows that referenced it. README and a restore runbook updated.

Not applied: LINODE_TOKEN, CLOUDFLARE_API_TOKEN, FORGEJO_ADMIN_TOKEN are still
missing as repo secrets; writing them is a separate decision.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
jfraeys closed this pull request 2026-10-10 11:14:47 -04:00
All checks were successful
Lint / lint (pull_request) Successful in 1m8s
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!43
No description provided.