Paul O'Reilly ea7c11265b fix(repo-readonly): own read-only deploy key; workflow-script drops write-capable gitea-ssh/v1 ...

repo-readonly/v1 now declares write_targets: [], an ssh_hosts alias and its
own secrets_required (account platform-readonly.space:platform, a read-only
Gitea deploy key), and stages the key before cloning. workflow-script/v1 no
longer layers gitea-ssh/v1, so script nodes cannot push. Invariants updated:
credential layers in the composite must declare write_targets: [].

Bug 45a48685-23e9-4605-af1f-d93306108cef

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

2026-10-02 20:09:30 +13:00

2.6 KiB

Raw Blame History

View Raw