sean/seanfarm
Watch
1
0
Fork
You've already forked seanfarm
 0
Code Issues Pull requests Projects Releases 386 Packages Wiki Activity

feat(binjovi): guard n8n and BuildKit repositories #118

Merged
binjovi-bot merged 1 commit from feat/n8n-buildkit-binjovi-authority into trunk 2026-09-01 07:55:26 +00:00
Conversation 0 Commits 1 Files changed 11 +335 -12
sean commented 2026-09-01 07:51:27 +00:00
Owner
Copy link

Summary

  • declare signed Binjovi webhooks for sean/n8n and sean/buildkit
  • retain provider-owned main, trunk, and tag protections with the exact ProjectRegistry resource prefixes
  • grant the runtime and operator identities the least repository permissions needed by the normal release flow
  • permit release-train rebase while keeping fast-forward-only merge policy

Tests

  • bash tests/binjovi.sh
  • bash tests/binjovi-batch-release-policy.sh
  • bash tests/gitmirror-fleet.sh
  • kustomize build kubernetes/flux/infrastructure/binjovi
  • kustomize build kubernetes/flux/infrastructure/forgejo-users
  • kustomize build kubernetes/flux/infrastructure/gitmirrors
  • bash tests/check.sh
  • git diff --check

Order

Merge and deploy this change before sean/binjovi#324. This creates the provider evidence and webhook path that its ProjectRegistry entries require. The short interval before #324 deploys is intentionally fail-closed: n8n and BuildKit trunk merges wait for binjovi/ci.

## Summary - declare signed Binjovi webhooks for `sean/n8n` and `sean/buildkit` - retain provider-owned `main`, `trunk`, and tag protections with the exact ProjectRegistry resource prefixes - grant the runtime and operator identities the least repository permissions needed by the normal release flow - permit release-train rebase while keeping fast-forward-only merge policy ## Tests - `bash tests/binjovi.sh` - `bash tests/binjovi-batch-release-policy.sh` - `bash tests/gitmirror-fleet.sh` - `kustomize build kubernetes/flux/infrastructure/binjovi` - `kustomize build kubernetes/flux/infrastructure/forgejo-users` - `kustomize build kubernetes/flux/infrastructure/gitmirrors` - `bash tests/check.sh` - `git diff --check` ## Order Merge and deploy this change before `sean/binjovi#324`. This creates the provider evidence and webhook path that its ProjectRegistry entries require. The short interval before #324 deploys is intentionally fail-closed: n8n and BuildKit trunk merges wait for `binjovi/ci`.
feat(binjovi): guard n8n and buildkit repositories
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
a1ac7e9b7f
sean force-pushed feat/n8n-buildkit-binjovi-authority from a1ac7e9b7f
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
to 6d2f6e57af
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
2026-09-01 07:53:53 +00:00 Compare
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/seanfarm!118
No description provided.