History

cluade-reviewer-andresmgsl fbdce5284e fix: the ci-box token guidance says what a Forgejo token actually is Round finding from @codex-reviewer-andresmgsl, elevated to blocking by @grok-reviewer-andresmgsl and @kimi-reviewer-andresmgsl. Unanimous, and right. creds.md called the registration token "short-lived" and said it was "consumed at registration". Both are GitHub's facts, copied across the forge boundary with the rest of the sibling's shape. Forgejo's primary source, read rather than inferred: models/actions/runner_token.go — ActionRunnerToken has NO expiry field. Only IsActive, Created, Updated. NewRunnerToken flips IsActive false on prior tokens at the same scope and only there, so a token dies when somebody mints its replacement, never on a clock. routers/api/actions/runner/runner.go — Register reads the token, refuses it when !IsActive ("please use the latest one"), and returns WITHOUT setting IsActive = false. Registration does not spend it. One token registers as many runners as it is shown to. So it is long-lived and reusable — the precise opposite of the adjective, and GitHub's really does expire in about an hour, which is why runner-install.sh is correct to use it. This is not a wording nit because of where the wording lives. creds.md is spliced into the ci-box's own CONTEXT.md: it is the paragraph an agent INSIDE the box reads about its own credentials. Telling that reader the token self-expires is telling it a leaked one stops mattering on its own, while it is still registering runners. Pinned, not merely fixed, per codex's ask — the phrase arrived by copying from the GitHub sibling, so the same copy can bring it back. Four rows: absence from both files, and presence of the true claim, so the pin cannot be satisfied by deleting the sentence instead of correcting it. The first draft of the CIBOX pin was a phrase match and passed against the exact text it was written to catch — the old wording wrapped across two comment lines. It is a plain absence check now, and the file explains the ban without spelling the word. Mutation-checked: all four go red against the old wording, green after.	2026-07-28 16:18:33 +00:00
..
ci-box	fix: the ci-box token guidance says what a Forgejo token actually is	2026-07-28 16:18:33 +00:00
README.md	feat: Forgejo-native CI — a ci-box tenant and a forgejo-runner family	2026-07-27 20:40:54 +00:00

cluade-reviewer-andresmgsl fbdce5284e fix: the ci-box token guidance says what a Forgejo token actually is

Round finding from @codex-reviewer-andresmgsl, elevated to blocking by
@grok-reviewer-andresmgsl and @kimi-reviewer-andresmgsl. Unanimous, and right.

creds.md called the registration token "short-lived" and said it was "consumed
at registration". Both are GitHub's facts, copied across the forge boundary
with the rest of the sibling's shape. Forgejo's primary source, read rather
than inferred:

  models/actions/runner_token.go — ActionRunnerToken has NO expiry field. Only
  IsActive, Created, Updated. NewRunnerToken flips IsActive false on prior
  tokens at the same scope and only there, so a token dies when somebody mints
  its replacement, never on a clock.

  routers/api/actions/runner/runner.go — Register reads the token, refuses it
  when !IsActive ("please use the latest one"), and returns WITHOUT setting
  IsActive = false. Registration does not spend it. One token registers as many
  runners as it is shown to.

So it is long-lived and reusable — the precise opposite of the adjective, and
GitHub's really does expire in about an hour, which is why runner-install.sh is
correct to use it.

This is not a wording nit because of where the wording lives. creds.md is
spliced into the ci-box's own CONTEXT.md: it is the paragraph an agent INSIDE
the box reads about its own credentials. Telling that reader the token
self-expires is telling it a leaked one stops mattering on its own, while it is
still registering runners.

Pinned, not merely fixed, per codex's ask — the phrase arrived by copying from
the GitHub sibling, so the same copy can bring it back. Four rows: absence from
both files, and presence of the true claim, so the pin cannot be satisfied by
deleting the sentence instead of correcting it. The first draft of the CIBOX
pin was a phrase match and passed against the exact text it was written to
catch — the old wording wrapped across two comment lines. It is a plain absence
check now, and the file explains the ban without spelling the word.

Mutation-checked: all four go red against the old wording, green after.

2026-07-28 16:18:33 +00:00

ci-box

fix: the ci-box token guidance says what a Forgejo token actually is

2026-07-28 16:18:33 +00:00

README.md

feat: Forgejo-native CI — a ci-box tenant and a forgejo-runner family

2026-07-27 20:40:54 +00:00

README.md

Staged template definitions

Definitions here are not the registry. They are role definitions destined for heavy-duty/rig-templates, staged in rig's tree only while the registry repo does not yet exist on the forge that will serve them (#109).

This is deliberately a waiting room, not a second registry:

bootstrap-tenant.sh does not look here. Nothing in this directory is reachable by a mint, and adding a lookup would recreate exactly the coupling the registry split was written to remove — where adding a tenant meant editing rig.
test/cli.sh lints each one with rig template-lint, the same parser a mint runs. A definition that cannot pass the schema never reaches the registry.
When the registry repo exists, a definition moves there verbatim and is deleted from here in the same PR.

To try one before it is anywhere, point a mint at it directly:

RIG_TEMPLATES_DIR=docs/templates rig bootstrap ci-box

That is RIG_TEMPLATES_DIR's stated purpose — "try a template before it exists anywhere" — and it is the supported path, not a workaround.