unkinben
c20e7e4664
ci/woodpecker/push/apply Pipeline was successful
Why: AI coding agents authenticate to Gitea as Ben using Ben's token. With the unkin-agent identity now in place (terraform-git PR #59), the agents AppRole should issue that account's tokens directly so agent commits and PRs are attributable and carry only least-privilege scopes. How: - add a gitea secrets-engine role minting ephemeral tokens for unkin-agent scoped to write:repository, write:issue, read:user — push branches and open PRs, never merge or administer - add a policy granting read on gitea/creds/unkin-agent, bound to the agents AppRole, mirroring the agent-* Kubernetes creds bindings Depends on terraform-git PR #59: the unkin-agent Gitea account must exist before minted tokens work. The vault-plugin-secrets-gitea engine is already live (plugin v0.1.0 registered, gitea mount configured), so no engine/plugin change is needed here. Reviewed-on: #114 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
21 lines
934 B
YAML
21 lines
934 B
YAML
# Role minting ephemeral tokens for the unkin-agent bot user -- the shared
|
|
# identity Ben's AI coding agents use to submit work. The agent clones/pushes
|
|
# code and opens pull requests, so it gets write on repositories (clone + push +
|
|
# PR create) and write on issues (PR/issue comments). Read is implied by write.
|
|
# No admin/org/user-write scopes, so it can never merge via API privilege; merge
|
|
# is blocked separately by branch protection (merge whitelist = Owners).
|
|
# read:user is required because tea (and most API clients) validate the login
|
|
# via GET /api/v1/user, which 403s without it.
|
|
# Reading gitea/creds/unkin-agent mints a lease-bound token deleted from Gitea
|
|
# on revoke/expiry. Consumed by the "agents" AppRole (see
|
|
# policies/gitea/creds/unkin-agent.yaml).
|
|
---
|
|
username: unkin-agent
|
|
scopes:
|
|
- write:repository
|
|
- write:issue
|
|
- read:user
|
|
token_name_prefix: vault-unkin-agent
|
|
ttl: 3600 # 1h
|
|
max_ttl: 14400 # 4h
|