feat: add the Forgejo registry push credential #8

Merged

goern merged 1 commit from feat/promote-pushes-to-forgejo into main

2026-07-28 20:33:47 +00:00

goern commented

2026-07-28 20:33:28 +00:00

Owner

Adds forgejo-b4mad-packages so promote-to-stage can push images to the Forgejo registry. Pairs with feeldata2.app#… — merge together.

What

forgejo-b4mad-packages carries b4mad-release-bot's username/password in the username/password shape the registry-auth workspace expects (cat /workspace/registry-auth/username).

Two identities, on purpose

Bot	Scope	Used for
`b4mad-gitops`	`write:repository`, `write:issue`	CI trigger + manifest commits
`b4mad-release-bot`	`write:package` (+ repo/issue)	image pushes

Neither holds the other's capability, so a leak of one doesn't grant the other's blast radius.

⚠️ write:package alone is not sufficient — the bot also needs org membership, or pushes fail as a bare authentication required rather than a permission error. b4mad-release-bot was added to a new feeldata DevSecOps team mirroring the toolbxs one.

Verification

Push to feeldata/* verified with these exact credentials before sealing (pushed a throwaway tag, confirmed, deleted it)
kubeseal --validate — the live controller can decrypt the seal
kustomize build environments/dev → clean, 11 SealedSecrets
The token appears in no committed file

Cleanup noted, not done

The codeberg-* secrets are now referenced by nothing. They're kept only as the rollback path for the forge move — drop them when the Codeberg org is retired. codeberg-b4mad-packages additionally holds a stale password that already fails auth, so it has no value even as a fallback.

Adds `forgejo-b4mad-packages` so `promote-to-stage` can push images to the Forgejo registry. Pairs with `feeldata2.app#…` — merge together. ## What `forgejo-b4mad-packages` carries `b4mad-release-bot`'s username/password in the `username`/`password` shape the `registry-auth` workspace expects (`cat /workspace/registry-auth/username`). ## Two identities, on purpose | Bot | Scope | Used for | |---|---|---| | `b4mad-gitops` | `write:repository`, `write:issue` | CI trigger + manifest commits | | `b4mad-release-bot` | `write:package` (+ repo/issue) | image pushes | Neither holds the other's capability, so a leak of one doesn't grant the other's blast radius. ⚠️ `write:package` alone is **not sufficient** — the bot also needs org membership, or pushes fail as a bare `authentication required` rather than a permission error. `b4mad-release-bot` was added to a new `feeldata` `DevSecOps` team mirroring the `toolbxs` one. ## Verification - Push to `feeldata/*` verified with these exact credentials before sealing (pushed a throwaway tag, confirmed, deleted it) - `kubeseal --validate` — the live controller can decrypt the seal - `kustomize build environments/dev` → clean, 11 SealedSecrets - The token appears in no committed file ## Cleanup noted, not done The `codeberg-*` secrets are now referenced by nothing. They're kept only as the rollback path for the forge move — drop them when the Codeberg org is retired. `codeberg-b4mad-packages` additionally holds a **stale password that already fails auth**, so it has no value even as a fallback.

goern added 1 commit

2026-07-28 20:33:28 +00:00

feat: ✨ add the Forgejo registry push credential a4993d1888

forgejo-b4mad-packages carries b4mad-release-bot's username/password for
forgejo.b4mad.net, in the username/password shape the promote-to-stage
registry-auth workspace expects.

b4mad-release-bot is the write:package identity and is separate from
b4mad-gitops, which triggers CI and pushes manifest commits but deliberately
holds no package scope. Push access was verified against feeldata/* before
sealing — that requires org membership as well as the scope, which is why
b4mad-release-bot was added to the feeldata DevSecOps team.

The codeberg-* secrets are now referenced by nothing and are kept only as the
rollback path; codeberg-b4mad-packages additionally holds a stale password
that already fails auth.

goern merged commit 527fd27c99 into main

2026-07-28 20:33:47 +00:00

goern deleted branch feat/promote-pushes-to-forgejo

2026-07-28 20:33:47 +00:00

goern referenced this pull request from a commit

2026-07-28 20:33:49 +00:00

Merge pull request 'feat: add the Forgejo registry push credential' (#8) from feat/promote-pushes-to-forgejo into main