levior/cli
Watch
12
0
Fork
You've already forked cli
 0
Code Issues 1 Pull requests Projects Releases 30 Packages Wiki Activity Actions

feat: headless login for services, and levior repo log #31

Merged
simlau merged 1 commit from simlau/headless into main 2026-10-28 13:14:00 +00:00
Conversation 0 Commits 1 Files changed 13 +350 -8
simlau commented 2026-10-28 12:50:46 +00:00
Owner
Copy link

Holmes runs the CLI in the cluster, where nobody can log in through a
browser:

  • LEVIOR_CLIENT_ID/LEVIOR_CLIENT_SECRET/LEVIOR_PROJECT_ID: a Zitadel
    machine user's client credentials. The JWT access token has the project
    as audience and the team roles as groups, by scope (tested against
    idp.levior.io with infra's holmes user). Not stored.
  • LEVIOR_FORGEJO_TOKEN: a Forgejo token for levior pr and repo log.
  • cli-api accepts the project (PROJECT_ID) as a second audience and names
    a caller without email by its client_id.
  • levior repo log: commit history with each author's Forgejo login, so
    Holmes can tie an image's sha to its commit and author.
Holmes runs the CLI in the cluster, where nobody can log in through a browser: - LEVIOR_CLIENT_ID/LEVIOR_CLIENT_SECRET/LEVIOR_PROJECT_ID: a Zitadel machine user's client credentials. The JWT access token has the project as audience and the team roles as groups, by scope (tested against idp.levior.io with infra's holmes user). Not stored. - LEVIOR_FORGEJO_TOKEN: a Forgejo token for levior pr and repo log. - cli-api accepts the project (PROJECT_ID) as a second audience and names a caller without email by its client_id. - levior repo log: commit history with each author's Forgejo login, so Holmes can tie an image's sha to its commit and author.
feat: headless login for services, and levior repo log
All checks were successful
ci / test (pull_request) Successful in 29s
Details
ci / image-build (pull_request) Successful in 6s
Details
ci / image (pull_request) Has been skipped
Details
ci / release (pull_request) Has been skipped
Details
6fda1624ef 
Holmes runs the CLI in the cluster, where nobody can log in through a
browser:
- LEVIOR_CLIENT_ID/LEVIOR_CLIENT_SECRET/LEVIOR_PROJECT_ID: a Zitadel
  machine user's client credentials. The JWT access token has the project
  as audience and the team roles as groups, by scope (tested against
  idp.levior.io with infra's holmes user). Not stored.
- LEVIOR_FORGEJO_TOKEN: a Forgejo token for levior pr and repo log.
- cli-api accepts the project (PROJECT_ID) as a second audience and names
  a caller without email by its client_id.
- levior repo log: commit history with each author's Forgejo login, so
  Holmes can tie an image's sha to its commit and author.
simlau merged commit e62b119ebe into main 2026-10-28 13:14:00 +00:00
simlau deleted branch simlau/headless 2026-10-28 13:14:00 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:scotland-yard
Hand this issue to Scotland Yard (Paperclip)

No labels
agent:scotland-yard
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
levior/cli!31
No description provided.