lambadalambda/opencode-forgejo-bot
Watch
0
0
Fork
You've already forked opencode-forgejo-bot
 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

Replace publication harness with autonomous Forgejo agent #14

Merged
lambadalambda merged 1 commit from feat/autonomous-agent into main 2026-08-30 11:03:28 +00:00
Conversation 0 Commits 1 Files changed 72 +2702 -21812
lambadalambda commented 2026-08-30 11:03:14 +00:00
Owner
Copy link

Summary

  • replace the preparer/discussion/publisher harness with one disposable autonomous OpenCode process
  • give the deliberately compromisable agent a dedicated public-only Forgejo token and live git/tea workflow
  • retain webhook authentication, trusted user/team authorization, immutable queueing, leases, bounded rootless Podman execution, and fixed bookkeeping
  • add at-most-once launch authorization, bounded preflight retries, supersession serialization, and reconciliation quarantine for uncertain cleanup
  • remove obsolete trusted publication components and document the incompatible atomic migration

Security boundary

  • dispatcher token is read-only
  • agent token scopes are exactly public-only, write:issue, write:repository, and read:user
  • agent account is not an upstream org member/collaborator/admin and may push only to its public forks
  • repository code can intentionally read/exfiltrate both agent credentials; revocation plus launcher stop is the kill switch

Verification

  • GOMAXPROCS=1 go test -p 1 ./...
  • GOMAXPROCS=1 go vet -p 1 ./...
  • GOMAXPROCS=1 sh scripts/adversarial-check.sh
  • git diff --check
  • worker and dispatcher images built locally with Podman
  • two independent security/architecture reviews: no remaining actionable findings

The proxy image was not rebuilt locally because its pinned base image was absent and verification uses --pull=never; the Squid configuration change is covered by static tests.

## Summary - replace the preparer/discussion/publisher harness with one disposable autonomous OpenCode process - give the deliberately compromisable agent a dedicated public-only Forgejo token and live `git`/`tea` workflow - retain webhook authentication, trusted user/team authorization, immutable queueing, leases, bounded rootless Podman execution, and fixed bookkeeping - add at-most-once launch authorization, bounded preflight retries, supersession serialization, and reconciliation quarantine for uncertain cleanup - remove obsolete trusted publication components and document the incompatible atomic migration ## Security boundary - dispatcher token is read-only - agent token scopes are exactly `public-only`, `write:issue`, `write:repository`, and `read:user` - agent account is not an upstream org member/collaborator/admin and may push only to its public forks - repository code can intentionally read/exfiltrate both agent credentials; revocation plus launcher stop is the kill switch ## Verification - `GOMAXPROCS=1 go test -p 1 ./...` - `GOMAXPROCS=1 go vet -p 1 ./...` - `GOMAXPROCS=1 sh scripts/adversarial-check.sh` - `git diff --check` - worker and dispatcher images built locally with Podman - two independent security/architecture reviews: no remaining actionable findings The proxy image was not rebuilt locally because its pinned base image was absent and verification uses `--pull=never`; the Squid configuration change is covered by static tests.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
lambadalambda/opencode-forgejo-bot!14
No description provided.