122 lines
3.6 KiB
YAML
122 lines
3.6 KiB
YAML
# Merge this fragment into docs/gitops/openapi-chatgpt-actions.yaml.
|
|
components:
|
|
schemas:
|
|
AuthorizedTaskWriterProvisionRequest:
|
|
type: object
|
|
additionalProperties: false
|
|
required:
|
|
- task_id
|
|
- repository
|
|
- base_ref
|
|
- base_oid
|
|
- target_branch
|
|
- owner_authorization_reference
|
|
- one_time_use
|
|
- expires_in_seconds
|
|
- production_change_authorized
|
|
- tag_change_authorized
|
|
- baseline_change_authorized
|
|
- main_write_authorized
|
|
- allowed_operations
|
|
- denied_operations
|
|
properties:
|
|
task_id:
|
|
type: string
|
|
pattern: '^[A-Z0-9][A-Z0-9._:-]{7,127}$'
|
|
repository:
|
|
type: string
|
|
const: aios/aios
|
|
base_ref:
|
|
type: string
|
|
const: refs/heads/main
|
|
base_oid:
|
|
type: string
|
|
pattern: '^[0-9a-f]{40}$'
|
|
target_branch:
|
|
type: string
|
|
pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'
|
|
owner_authorization_reference:
|
|
type: string
|
|
minLength: 4
|
|
maxLength: 256
|
|
one_time_use:
|
|
type: boolean
|
|
const: true
|
|
expires_in_seconds:
|
|
type: integer
|
|
minimum: 60
|
|
maximum: 1800
|
|
production_change_authorized:
|
|
type: boolean
|
|
const: false
|
|
tag_change_authorized:
|
|
type: boolean
|
|
const: false
|
|
baseline_change_authorized:
|
|
type: boolean
|
|
const: false
|
|
main_write_authorized:
|
|
type: boolean
|
|
const: false
|
|
allowed_operations:
|
|
type: array
|
|
minItems: 4
|
|
maxItems: 4
|
|
uniqueItems: true
|
|
items:
|
|
type: string
|
|
enum:
|
|
- create_worktree
|
|
- create_target_branch_if_absent
|
|
- commit_to_target_branch
|
|
- push_target_branch
|
|
denied_operations:
|
|
type: array
|
|
minItems: 11
|
|
maxItems: 11
|
|
uniqueItems: true
|
|
items:
|
|
type: string
|
|
enum:
|
|
- direct_main_push
|
|
- force_push
|
|
- tag_create
|
|
- tag_update
|
|
- tag_delete
|
|
- branch_delete
|
|
- repository_admin
|
|
- baseline_write
|
|
- production_deploy
|
|
- production_marker_write
|
|
- history_rewrite
|
|
|
|
paths:
|
|
/api/task-writer/provision-authorized:
|
|
post:
|
|
operationId: provisionAuthorizedTaskWriter
|
|
summary: Convert authenticated Owner authorization into a signed one-time task writer grant
|
|
description: >
|
|
Generates an approval plan, invokes the root-governed signer and validator,
|
|
consumes a one-time provisioning grant, and returns a scoped writer
|
|
attestation. It never authorizes main, tag, baseline, or production changes.
|
|
x-openai-isConsequential: true
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/AuthorizedTaskWriterProvisionRequest'
|
|
responses:
|
|
'200':
|
|
description: READY_FOR_CODE_AUTHORING or idempotent existing attestation
|
|
'400':
|
|
description: Invalid or over-broad request
|
|
'403':
|
|
description: Authenticated Owner or exact scope required
|
|
'409':
|
|
description: Base drift, branch conflict, or idempotency scope conflict
|
|
'503':
|
|
description: Signer, validator, provisioner, or attestation unavailable
|