platform-ci/runtime/checkout-bindings.yaml

# Operator-owned authorization manifest for pinned private checkouts (execution remains untested).
#
# A consumer repository's `.ci.yaml` names its own dependency (`components.<name>.checkouts.<dependency>`: a logical `binding`, a `repository`, a full
# commit `ref` and a `path`). This file decides who may read what. A binding authorizes the listed CONSUMING repositories to read the listed
# DEPENDENCY repositories through the one existing read-only repository secret the shared workflow forwards to the checkout step, and to nothing
# else. An empty `bindings` mapping authorizes nothing, so a consumer that declares a checkout fails before its build starts.
#
# Shape of one binding (do not guess values; record the operator's inventory):
#   bindings:
#     <logical-name>:                  # lowercase, e.g. the name a consumer's `.ci.yaml` uses in `binding:`
#       secret: PUBLISHER_CHECKOUT_TOKEN   # must name the existing slot the workflow forwards; no other secret is possible
#       consumers: [<owner>/<name>]    # repositories whose runs may use this binding
#       repositories: [<owner>/<name>] # repositories those runs may read
#
# Prerequisites before a consumer can use it (operator-owned, none is created here): (1) the existing read-only secret PUBLISHER_CHECKOUT_TOKEN is
# available to that consumer's runs and its token can read the listed dependency repositories; (2) the dependency commit is pinned in the consumer's
# `.ci.yaml`; (3) this manifest, in the reviewed platform revision, lists the pair.
schema: 1
bindings:
  content-validator-source:
    secret: PUBLISHER_CHECKOUT_TOKEN
    consumers: [KofTwentyTwo/Website-Content]
    repositories: [KofTwentyTwo/Website-Publisher]