platform-ci/runtime/package-reader-bindings.yaml

# Operator-owned authorization manifest for READ-ONLY private Maven package access before a component's verification.
#
# A consumer repository's `.ci.yaml` names a logical binding (`components.<name>.package_reads.binding`). This file decides who may use it: which
# repositories' runs may use the one repository secret slot the shared workflow forwards to the `prefetch-packages` step ALONE, and as which registry
# user the token authenticates. The step runs only for a push to the repository's default branch, or for a same-repository pull request whose forge-supplied
# head commit is an exact entry of the binding's `reviewed_commits` (empty by default, so inert); never for forks, other commits, tags, feature-branch pushes
# or image jobs, and neither path writes the dependency cache. It fills the local Maven repository with the component's dependencies and plugins, then deletes the credentialed settings; the
# verification that follows never sees the token. The registry is https://git.kof22.com/api/packages/QRun-IO/maven.
#
# Operator prerequisites (none is created by this repository; no credential value is recorded anywhere):
#   1. A repository secret named PACKAGE_READ_TOKEN on each consumer, holding a read:package-only token of the EXISTING read-only identity named below.
#   2. That identity must be able to read the QRun-IO Maven packages. Gitea metadata observed 2026-11-05: `qqq-package-reader` is the only member of the
#      QRun-IO `package-reader` team (repo.packages: read); `kof-package-reader` is only in the KofTwentyTwo `package-reader` team, so it cannot read QRun-IO.
#
# Shape (each binding has exactly these keys):
#   bindings:
#     <logical-name>:
#       secret: PACKAGE_READ_TOKEN         # the one slot name the workflow forwards
#       username: <registry user of the token>
#       consumers: [<owner>/<name>]        # repositories whose runs may use it
#       reviewed_commits: [<40-hex>, ...]  # optional, default EMPTY (inert): exact full commit ids of reviewed sources. A SAME-REPOSITORY pull request
#                                          # whose forge-supplied head commit equals one of them may prefetch (bootstrap of the first private-package
#                                          # change). Filled only by protected metadata review after the commit exists; no branch names, no patterns.
schema: 1
bindings:
  kof22-qrun-read:
    secret: PACKAGE_READ_TOKEN
    username: qqq-package-reader
    consumers: [KofTwentyTwo/Website-Backend]
    reviewed_commits: []