land feat/forgejo-token-crd (29f90795c1) #19

Open

pipeline-bot wants to merge 1 commit from feat/forgejo-token-crd into trunk

pull from: feat/forgejo-token-crd

merge into: sean:trunk

sean:main

sean:trunk

Conversation 0 Commits 1 Files changed 13 +1132

pipeline-bot commented 2026-07-07 18:41:33 +00:00

Collaborator

Copy link

No description provided.

pipeline-bot added 1 commit 2026-07-07 18:41:33 +00:00

feat(forgejotoken): CRD + controller to mint & rotate Forgejo PATs ... 29f90795c1

Adds a ForgejoToken CRD that declaratively mints a scoped Forgejo personal
access token into a Secret and rotates it. Authenticates as spec.username via
HTTP Basic auth with the password in spec.authSecretRef (Forgejo token-create
is BasicAuth-only), mints a uniquely-named PAT, publishes it to spec.output,
then revokes the prior one (mint-before-revoke, no credential gap).

Rotation is controller-enforced on spec.rotateEvery (default 168h) since
Forgejo 14 PATs have no server-side expiry, and re-mints whenever the active
token is missing server-side (e.g. after a migration wipes tokens) so the
credential self-heals instead of going stale. Owns tokens by name prefix,
prunes stragglers, revokes on delete. Retires the one-shot never-rotating
*-token-issuer Jobs (forgejo-admin-token / forgejo-pipeline-bot-token).

This pull request has changes conflicting with the target branch.

• CHANGELOG.md
• api/v1alpha1/forgejotoken_types.go
• api/v1alpha1/zz_generated.deepcopy.go
• config/crd/bases/forgejo.forgejo.io_forgejotokens.yaml
• internal/controller/forgejotoken_controller.go
• internal/controller/forgejotoken_impl.go
• internal/controller/helpers.go

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title Merge pull request 'land feat/forgejo-token-crd (29f90795c10b)' (#19) from feat/forgejo-token-crd into trunk

Merge commit body Reviewed-on: https://code.sean.farm/sean/forgejo-operator/pulls/19

Merge pull request 'land feat/forgejo-token-crd (29f90795c10b)' (#19) from feat/forgejo-token-crd into trunk Reviewed-on: https://code.sean.farm/sean/forgejo-operator/pulls/19 Copy merge commit message

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/forgejo-token-crd:feat/forgejo-token-crd

git switch feat/forgejo-token-crd

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/forgejo-operator!19

No description provided.