Identity and repository roles
Native Access maps to an enrolled D1 account; portable sessions map to supported Forgejo permissions. Instance administrators still need permission for each repository.
GOLF Product / Security
Keep authority where it belongs.
Golf checks current identity, repository permission, source and policy at the boundaries that control reads, writes, execution and previews.
Developer preview · capability review October 14, 202601 / TRUST
A token is not the whole permission model.
Native and portable runtimes have explicit authority paths.
Credential handling
Native broker authority and keys stay in Secrets Store; portable credentials use the authenticated keyring. Provider tokens never enter browser storage or public examples.
Private outputs
Immutable source and R2 report reads still require current permission. Revocation and expiry are checked at the documented runtime boundaries.
02 / EXECUTION
Constrain what the job can do.
Evidence, proposals and publication have different powers.
Approved exact source
Use selected profiles, approved images, exact workflow/commit authority and bounded network routes. Independent proposals live on Artifacts forks.
Secret release
Native values reach only exact-approved PR workflow jobs. Stored logs mask exact text, not transformations. Broader scopes, rotation and external egress remain open.
Protected previews
Access plus Golf current-reader checks, expiry, isolated app bindings and outbound policy protect previews. This does not imply production promotion.
03 / ACCEPTANCE
Security claims need their own proof.
The product is a developer preview.
Protected publication
Native ancestor-base merges have bounded proof; complete trusted checks, review eligibility and protected merge remain open.
Migration and recovery
Historical provider evidence does not qualify Forgejo restore or native disaster recovery. Privileged offline restore requires a fresh, stopped quarantined target and drained writers.
Production assurance
Hostile tenancy, customer identity/onboarding, global scale, audit/retention and enterprise/government distributions remain explicit qualification work.
Make your first move.
Explore the hosted public repository, request enrollment for private workflows, or start your own portable installation.