feat(binjovi): guard extracted runtime repositories #122

Merged

binjovi-bot merged 2 commits from feat/extracted-four-binjovi-authority into trunk

2026-09-01 08:25:43 +00:00

sean commented

2026-09-01 08:12:08 +00:00

Owner

Summary

declare signed Binjovi webhooks for sean/argo-workflows, sean/athens, sean/gibson, and sean/pkg-host
retain provider-owned main, trunk, and tag protections with the exact default ProjectRegistry names
grant the runtime and operator identities the least repository permissions needed by the normal release flow
permit release-train rebase while keeping fast-forward-only merge policy

Tests

bash tests/binjovi.sh
bash tests/binjovi-batch-release-policy.sh
bash tests/gitmirror-fleet.sh
kustomize build kubernetes/flux/infrastructure/binjovi
kustomize build kubernetes/flux/infrastructure/forgejo-users
kustomize build kubernetes/flux/infrastructure/gitmirrors
bash tests/check.sh
git diff --check

Order

Merge and deploy this change before the Binjovi runtime-batch change at 5956f5c. This creates the provider evidence and signed webhook path that its ProjectRegistry entries require. The short interval before Binjovi deploys is intentionally fail-closed: protected trunk merges wait for binjovi/ci.

Provider authority follow-up

add all 18 n8n, BuildKit, and runtime-batch protection names to the read-only binjovi-provider-authority Role
require every provider-guarded protection manifest in the Binjovi Kustomization to have all object names in that Role
preserve get as the only protection-object verb

## Summary - declare signed Binjovi webhooks for `sean/argo-workflows`, `sean/athens`, `sean/gibson`, and `sean/pkg-host` - retain provider-owned `main`, `trunk`, and tag protections with the exact default ProjectRegistry names - grant the runtime and operator identities the least repository permissions needed by the normal release flow - permit release-train rebase while keeping fast-forward-only merge policy ## Tests - `bash tests/binjovi.sh` - `bash tests/binjovi-batch-release-policy.sh` - `bash tests/gitmirror-fleet.sh` - `kustomize build kubernetes/flux/infrastructure/binjovi` - `kustomize build kubernetes/flux/infrastructure/forgejo-users` - `kustomize build kubernetes/flux/infrastructure/gitmirrors` - `bash tests/check.sh` - `git diff --check` ## Order Merge and deploy this change before the Binjovi runtime-batch change at `5956f5c`. This creates the provider evidence and signed webhook path that its ProjectRegistry entries require. The short interval before Binjovi deploys is intentionally fail-closed: protected trunk merges wait for `binjovi/ci`. ## Provider authority follow-up - add all 18 n8n, BuildKit, and runtime-batch protection names to the read-only `binjovi-provider-authority` Role - require every provider-guarded protection manifest in the Binjovi Kustomization to have all object names in that Role - preserve `get` as the only protection-object verb

sean added 1 commit

2026-09-01 08:12:09 +00:00