5f85d895c1
The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.
Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).
Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
34 lines
800 B
YAML
34 lines
800 B
YAML
kind: context
|
|
name: gitea-admin
|
|
version: 1
|
|
description: "Gitea admin: SSH, git identity, API token for skynet org"
|
|
requires:
|
|
- anthropic-cloud/v1
|
|
provides: [gitea-admin]
|
|
|
|
git_identity:
|
|
name: "agent-runtimes"
|
|
email: "agent@oreillyit.nz"
|
|
|
|
ssh_hosts:
|
|
- alias: gitea.oreillyit.nz-ai-enablement
|
|
hostname: gitea.oreillyit.nz
|
|
user: git
|
|
identity_secret: SSH_KEY_AI_ENABLEMENT
|
|
|
|
secrets_required:
|
|
# ESO-managed gitea-admin token (M22 Phase 9)
|
|
- name: gitea-admin
|
|
account_ref: "gitea-admin"
|
|
mount_path: /run/agent/secrets/gitea-admin
|
|
mode: "0400"
|
|
# Legacy SSH key (file-based, already delivered as mount)
|
|
- name: SSH_KEY_AI_ENABLEMENT
|
|
mount: /home/agent/.ssh/id_ed25519
|
|
mode: "0600"
|
|
|
|
env:
|
|
GITEA_BASE_URL: "https://gitea.oreillyit.nz"
|
|
|
|
scripts:
|
|
init: ./init.sh |