Commit c9fbc9ba authored by Konstantinos Togias's avatar Konstantinos Togias
Browse files

docs(ci): clarify artifact, registry and metadata access boundaries

parent 03d0e2dc
Loading
Loading
Loading
Loading
+6 −3
Changes for ci/sdk-consumer.md: 6 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -38,6 +38,9 @@ resolver creates its own isolated environment; an existing SDK version need
not be published first. Supply the matching pinned `CI_JOB_IMAGE` if preparing
inputs for the CI image build.

The SRM job-token allowlist must admit the SDK producer for branch/MR metadata
and Ansible for read-only consumer artifacts/registry access. Configure these
project entries through maintainer review. No personal token is needed.
SDK must admit SRM job tokens for exact build-artifact downloads. SRM admits the
SDK trigger and must admit Ansible for consumer registry pulls. The current
ETSI selection and lab read public project metadata; a job token alone does not
grant general pipeline/branch API access. Private metadata needs separately
reviewed read permissions. Configure only the required project allowlist entries
through maintainer review. No personal token is introduced.