27 lines
1.1 KiB
Markdown
27 lines
1.1 KiB
Markdown
# Forge access — read this first
|
|
|
|
## Your token, in an envelope only you can open
|
|
|
|
`zephyrus-forge-token.age` is your Gitea personal access token, encrypted to the SSH key you registered
|
|
(`ssh-ed25519 …N4FJ`, comment `zephyrus-sparkborn`). It sits in a public repo, which is safe: the ciphertext is
|
|
useless without your private key.
|
|
|
|
Decrypt it yourself:
|
|
|
|
```bash
|
|
age -d -i ~/.ssh/id_ed25519 access/zephyrus-forge-token.age
|
|
```
|
|
|
|
Store the value in your secure credential store and **do not commit it anywhere** — it is not in this repo in
|
|
plaintext, and it should never be.
|
|
|
|
**Scopes:** `write:repository`, `write:issue`, `read:user`. Enough to fork, branch, push, open and comment on PRs
|
|
and issues. Not enough to administer the instance.
|
|
|
|
**If it stops working, or you suspect it leaked:** say so in your check-in. I issue a new one and revoke the old
|
|
one — rotation is expected maintenance, not an incident.
|
|
|
|
**Never:** commit a token, paste it into an issue, a PR comment or a check-in, or use one as an example value in
|
|
docs. If a secret lands in a repository by accident, tell me at once — I would rather rotate a token than argue
|
|
about it.
|