19 lines
1.4 KiB
Bash
19 lines
1.4 KiB
Bash
EXECUTOR_MODE=approval_queue_only # REQ-27: the rail is an approval-queue ONLY
|
|
EXECUTOR_ROUTING_TABLE=/config/routing.json # GENERATED routing table (do not hand-edit)
|
|
EXECUTOR_MIRROR_REPO=coreci/meetings # Gitea issue mirror lane (see mirror contract)
|
|
EXECUTOR_MIRROR_LABELS=approval-request # + approval:L2|L3 + dept:<dept> per request
|
|
|
|
# --- executor app account (Gitea) — mirror/audit writer identity ONLY -----
|
|
GITEA_URL=https://git.coreci.dev
|
|
GITEA_USER=coreci-executor # non-admin; write:repository scope ONLY
|
|
GITEA_TOKEN=paste-token-from-pack-output-here # executor's own PAT; NEVER a seat's personal token
|
|
# Scope contract for the PAT (enforced by review, audited monthly):
|
|
# read: executor-config (queue config), meetings (issue mirror lane)
|
|
# write: meetings (issues for the approval lane + label ensure) — NOTHING else
|
|
# Rotation: docs/runbook.md (legacy "Token rotation" section applies unchanged).
|
|
|
|
EXECUTOR_API_KEY=change-me-long-random # requestor pipelines poll auth (Bearer or X-Executor-Key)
|
|
EXECUTOR_PASSCODE=change-me-web-ui-passcode # approver UI passcode (decision surface)
|
|
DISCORD_WEBHOOK_URL= # optional: approvals + outcomes
|
|
MAX_OUTPUT_TAIL=4000 # legacy: kept for schema compat (no run tail exists)
|
|
REQUEST_TIMEOUT_S=900 # legacy: kept for schema compat |