21 lines
696 B
HCL
21 lines
696 B
HCL
# ACL policy for the Forgejo Actions deploy token.
|
|
#
|
|
# Scopes: read the default namespace (job list / deployment status polling),
|
|
# full control over the contract-check job only. The token cannot touch
|
|
# agents, other jobs, or Nomad Variables (set via the management token).
|
|
#
|
|
# Apply with the management token (README §4):
|
|
# nomad acl policy apply -description "Forgejo CI deploy" ci \
|
|
# deploy/nomad/policies/ci.hcl
|
|
#
|
|
# If `nomad job run` from CI ever fails with permission errors during
|
|
# deployment evaluation, fall back to namespace-wide write:
|
|
# namespace "default" { policy = "write" }
|
|
|
|
namespace "default" {
|
|
policy = "read"
|
|
|
|
job "contract-check" {
|
|
policy = "write"
|
|
}
|
|
}
|