hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Wire Forge-native release infrastructure
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Waiting to run
Details
Build Rust / Cargo Test (push) Successful in 4m14s
Details
Build Site / Next.js Build (push) Failing after 6s
Details
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s
Details
Lint Governance / BEP Metadata (push) Successful in 0s
Details
Build: Android / Android Rust Core Stub (push) Failing after 23s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 05:51:12 -07:00
parent 97c569fb35
commit 002bd382e9
199 changed files with 14268 additions and 185 deletions
Download patch file Download diff file Expand all files Collapse all files

13
services/forgejo-nsc/README.md
View file

@ -152,13 +152,14 @@ generate a Namespace token from the logged-in namespace account, and render the
dispatcher/autoscaler configs into `intake/forgejo_nsc_{dispatcher,autoscaler}.yaml`
plus `intake/forgejo_nsc_token.txt`.
For ongoing operations, use `Scripts/sync-forgejo-nsc-config.sh`:
For ongoing operations, use `Scripts/seal-forgejo-nsc-secrets.sh`:
- `Scripts/sync-forgejo-nsc-config.sh` copies the intake-backed configs and
Namespace token onto `/var/lib/burrow/intake/` on the forge host, reapplies
file ownership for `forgejo-nsc`, and restarts the dispatcher/autoscaler.
- `Scripts/sync-forgejo-nsc-config.sh --rotate-pat` additionally mints a new
Forgejo PAT on the Burrow forge host and refreshes the local intake files.
- `Scripts/seal-forgejo-nsc-secrets.sh --provision` refreshes the local
Namespace token from the logged-in Namespace account, mints a Forgejo PAT,
renders the dispatcher/autoscaler configs, and seals those runtime inputs into
agenix secrets consumed by `burrow-forge`.
- Deploy `burrow-forge` after sealing so the dispatcher and autoscaler consume
the new Namespace credentials.
Run it next to the dispatcher: