Description
release-please.yml already references the permission set release-please-codingagent2otel, which does not exist yet. There is no PAT fallback: the old tokens are revoked and unrecoverable, so the only route is an OpenBao permission set, policy and JWT role.
Acceptance Criteria
- #1 A release-please-codingagent2otel permission set, policy and JWT role exist, created per the CI-SECRETS runbook
- #2 No RELEASE_PLEASE_TOKEN or DOCS_SYNC_PAT is created anywhere
- #3 release-please runs green and opens a release PR on a real commit
- #4 If docs-sync is wanted, the repo is added to docs-repos.json in m7kni-net-site and trigger-docs-sync.yml is copied in, with Contents write rather than actions write
- #5 The first release is cut and the manifest moves off 0.0.0
Definition of Done
- #1 just check passes: fmt-check, lint, build, test-short, probe-ci, dashboard-check and docs-links all clean
Implementation Plan
Wave 1 lane 11: root creates additive OpenBao/GitHub release plumbing from live sibling shape, wires shared workflows and repository settings, then proves the release broker mint step and release PR.
Implementation Notes
Authorised by Rob 2026-09-22: the wave may run bao login -method=oidc at any time and create the permission set, ACL policy and JWT role this repo needs, in line with the other repos. Additive only - never modify or delete another consumer’s objects, and a shared permission set is not yours to edit.
Runbook: ~/repos/chat-personal/camden/openbao/runbooks/CI-SECRETS.md, section “Adding a consumer”. It wins over any summary.
Non-guessable values: BAO_ADDR https://openbao.saga-turtle.ts.net rknightion installation_id 152037622 rknightion owner id 12484127 this repo’s numeric id 1381225038 permission set / role name release-please-codingagent2otel runner_environment claim github-hosted
Read a live sibling and copy its actual shape rather than deriving names from docs:
bao read auth/gha/role/release-please-codexlb2otel -> the exact token_policies name and bound_claims
bao policy read
Failure signatures:
auth/gha/login 400 the role does not exist under the name the workflow passed; bao list auth/gha/role first
login ok, mint 403 the policy the role names does not exist; the role write accepts any policy name unchecked
bound_claims type error it must be a JSON body, not the key=value CLI form
OIDC request returns nothing the job is missing permissions: id-token: write
mint finds no repository wrong installation_id; repositories is scoped within an installation
After onboarding, always bao policy read the exact name the role carries. portina shipped with a role naming a policy that had never been written; login succeeded and every mint 403’d for months.
Evidence bar: a green release-please run whose mint step was SKIPPED is not evidence. Read the mint step’s own output and quote the run id.
docs-sync is deferred, not done: it needs a docs-sync-codingagent2otel JWT role under the shared docs-sync permission set, an edit to docs-repos.json in m7kni/m7kni-net-site, and this repo wired for doc publication, which it is not.
docs-sync is NOT part of this task’s delivery. It is tracked separately as CAOT-0038 and was deferred out of wave 1 by Rob on 2026-09-22. This task creates the release-please objects only. The shared docs-sync permission set and its policy stay read-only.
Final Summary
OpenBao permission set, exact-path policy, and JWT role were created and read back; run 35715966330 proved the mint step and release PR 2, and run 35720241045 minted again and cut v0.1.0 with manifest 0.1.0. No legacy PAT was created; docs-sync remains separately deferred as CAOT-0038.