Tirsvad
a2bf2d4204
Add the use case diagram UCD-001, the user stories US-001 and the brief use cases UC-001 to UC-004 (Synchronize Repository Metadata, Configure Workflow Credentials, Onboard a Repository, Diagnose a Failed Workflow). Review and accept them (RC-019 to RC-024) and the PP-001 row that records them (RC-025), and update TM-001 and the registry. Task: MIL-002#1
1.6 KiB
UC-002: Configure Workflow Credentials
Metadata
| Key | Value |
|---|---|
| ID | UC-002 |
| CrossReference | UCD-001, US-001, SA-001 |
Version History
| Date | Status | Author | Reviewer | Change | Commit |
|---|---|---|---|---|---|
| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version | pending |
Format: Brief
Title: Configure Workflow Credentials Scope: Reusable Workflow Collection Level: user-goal Primary Actor: DevOps Professional Stakeholders: S05, S03, S02 (interests below) Stories: US-001.03, US-001.04
Brief
The DevOps Professional creates a Gitea token and a GitHub fine-grained token with the minimum permissions in the credentials guide, and the Platform Operator stores them once as secrets of the organization, each holding only the token. A run of the workflow checks that each token is accepted and, for GitHub, that it can administer the mirror, and reports Preflight passed without printing any secret value.
Stakeholder interests
- S05 — credentials are least-privilege and checked before use
- S03 — tokens are scoped, stored as secrets and never printed
- S02 — a failed credential check says which secret to fix
Preconditions: The actor has access to the Gitea and GitHub settings and can store secrets for the organization.
Postconditions (success guarantee): Both secrets hold only a token, a run passes the credential check with the documented minimum permissions, and no secret value appeared in a log.