sean/seanfarm
Watch
1
0
Fork
You've already forked seanfarm
 0
Code Issues Pull requests Projects Releases 386 Packages Wiki Activity

feat(binjovi): credential the isolated repo-creator release #697

Merged
binjovi-bot merged 2 commits from feat/wire-repo-creator-credentials into trunk 2026-09-13 10:26:45 +00:00
Conversation 0 Commits 2 Files changed 7 +186
sean commented 2026-09-13 10:21:41 +00:00
Owner
Copy link

Summary

Part A (seanfarm half) of enabling the create_repository MCP tool that
shipped inert in sean/binjovi PR #1716 (v0.1.706). Forgejo denies
repository creation to every non-admin identity
(FORGEJO__REPOSITORY__MAX_CREATION_LIMIT=0), so the isolated
repo-creator release needs its own site-admin Forgejo credential, and
this is the piece of that credential chain that lives in this repo.

  • binjovi-repo-creator-bot: the first ForgejoUser in the fleet with
    isAdmin: true. binjovi-bot and binjovi-operator-bot both stay
    isAdmin: false.
  • A ForgejoToken (write:admin + write:repository, verified against
    the live instance's own swagger.v1.json — adminCreateRepo and
    repoEdit are tagged admin and repository respectively) mints its
    PAT into forgejo-binjovi-repo-creator-token.
  • A dedicated ServiceAccount/Role/RoleBinding/ClusterSecretStore
    delivers only that one Secret into namespace binjovi, mirroring
    forgejo-writer.yaml exactly.
  • binjovi-app-database's OpenBaoKubernetesAuthRole gains
    binjovi-repo-creator as a bound ServiceAccount — the same static
    database credential, not a separate policy.
  • A new guard in tests/binjovi.sh asserts the token is reachable from
    nowhere else in the tree.

The sean/binjovi half (the isolated BINJOVI_RUNTIME=repo-creator
release, its Deployment, and the MCP policy grant) is a companion PR in
that repo. Once both are live, Outline's onboarding uses a single
create_repository MCP call instead of a ForgejoRepository CR.

Test plan

  • bash tests/binjovi.sh passes, including the new isolation guard
    (verified it fails when the credential is made reachable from
    db-access.yaml, then confirmed the fix removes the failure)
  • kubectl kustomize renders the whole binjovi component cleanly
  • Live smoke test: create_repository MCP call creates a disposable
    repo end-to-end (companion sean/binjovi PR must deploy first)

https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

## Summary Part A (seanfarm half) of enabling the `create_repository` MCP tool that shipped inert in `sean/binjovi` PR #1716 (v0.1.706). Forgejo denies repository creation to every non-admin identity (`FORGEJO__REPOSITORY__MAX_CREATION_LIMIT=0`), so the isolated repo-creator release needs its own site-admin Forgejo credential, and this is the piece of that credential chain that lives in this repo. - `binjovi-repo-creator-bot`: the first `ForgejoUser` in the fleet with `isAdmin: true`. `binjovi-bot` and `binjovi-operator-bot` both stay `isAdmin: false`. - A `ForgejoToken` (`write:admin` + `write:repository`, verified against the live instance's own `swagger.v1.json` — `adminCreateRepo` and `repoEdit` are tagged `admin` and `repository` respectively) mints its PAT into `forgejo-binjovi-repo-creator-token`. - A dedicated ServiceAccount/Role/RoleBinding/ClusterSecretStore delivers only that one Secret into namespace `binjovi`, mirroring `forgejo-writer.yaml` exactly. - `binjovi-app-database`'s `OpenBaoKubernetesAuthRole` gains `binjovi-repo-creator` as a bound ServiceAccount — the same static database credential, not a separate policy. - A new guard in `tests/binjovi.sh` asserts the token is reachable from nowhere else in the tree. The `sean/binjovi` half (the isolated `BINJOVI_RUNTIME=repo-creator` release, its Deployment, and the MCP policy grant) is a companion PR in that repo. Once both are live, Outline's onboarding uses a single `create_repository` MCP call instead of a `ForgejoRepository` CR. ## Test plan - [x] `bash tests/binjovi.sh` passes, including the new isolation guard (verified it fails when the credential is made reachable from `db-access.yaml`, then confirmed the fix removes the failure) - [x] `kubectl kustomize` renders the whole `binjovi` component cleanly - [ ] Live smoke test: `create_repository` MCP call creates a disposable repo end-to-end (companion `sean/binjovi` PR must deploy first) https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3
feat(binjovi): credential the isolated repo-creator release
Some checks failed
binjovi/ci Binjovi failed the frozen plan
Details
98fd9abc04
 
Forgejo denies repository creation to every non-admin identity
(FORGEJO__REPOSITORY__MAX_CREATION_LIMIT=0), so binjovi's isolated
repo-creator release needs a site-admin credential to create a
brand-new repository at all. This is the first ForgejoUser in the
fleet with isAdmin: true; binjovi-bot and binjovi-operator-bot both
stay isAdmin: false.

- binjovi-repo-creator-bot (ForgejoUser, isAdmin: true) + its own
  Password/ExternalSecret, in forgejo-users alongside every other bot.
- A ForgejoToken (write:admin + write:repository) mints its PAT into
  forgejo-binjovi-repo-creator-token.
- A dedicated ServiceAccount/Role/RoleBinding/ClusterSecretStore
  delivers only that one Secret into namespace binjovi, scoped by
  resourceNames the same way forgejo-writer already is.
- The existing binjovi-app-database OpenBaoKubernetesAuthRole gains
  binjovi-repo-creator as a bound ServiceAccount: the same static
  database credential, not a separate policy.
- A new guard in tests/binjovi.sh asserts this token is reachable from
  nowhere else in the tree -- no other Role, no other ClusterSecretStore.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3
fix(binjovi): replace a pipefail-unsafe grep -q reader
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
a99674cc59
 
no-sigpipe-readers.sh correctly rejected the isolation guard's trailing
pipe into grep -q: an early-exiting reader at the end of a pipefail
pipeline can SIGPIPE the upstream writer before it finishes, making the
exit status unreliable. Redirecting a non-quiet grep to /dev/null reads
to completion instead.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3
binjovi-bot deleted branch feat/wire-repo-creator-credentials 2026-09-13 10:26:45 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/seanfarm!697
No description provided.