Grant Whitmer 5b16114b98 auth: token contract v1 (aud windy_git, both issuers); CI for eternitas ...

- hub_jwt: aud list is ["windy_git"] (contract v1 array). Dropped
  "windy-git": that is Gitea's OIDC client_id, so a forge id_token would
  have passed the aud check. `type: human` is now REQUIRED (id_tokens have
  none), which makes accepting the discovery-URL issuer safe.
- runner job ceiling 30m -> 90m: eternitas's serial pytest is ~50 min and
  would have been killed mid-suite.
- eternitas (private) added to the GitHub status bridge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-23 02:58:56 -04:00

..

config.yaml

auth: token contract v1 (aud windy_git, both issuers); CI for eternitas

2026-09-23 02:58:56 -04:00

docker-compose.yml

ci: six runners; SSO #8 Gitea sign-in hardening (staged)

2026-09-23 02:51:56 -04:00

prune.sh

ci: prune.sh must address dind over TCP (it has no unix socket)

2026-09-23 02:47:35 -04:00

windygit-ci-prune.service

ci: bound CI storage; don't bridge image-build jobs

2026-09-23 02:47:28 -04:00

windygit-ci-prune.timer

ci: bound CI storage; don't bridge image-build jobs

2026-09-23 02:47:28 -04:00