Repository automation grants
Automation grants store explicit repository-bound delegation for future unattended work. Accepting a push, enabling push permission or saving a grant alone does not start a run. The opt-in automatic push integration now connects these prerequisites in disposable development stacks; disposable native qualification has passed, and the retained local schema021 runtime now has a deliberately scoped private demo.
Create and inspect a grant
Open Repository settings → Workflows (/repositories/{owner}/{name}/settings/workflows). Current repository owners and administrators can inspect the grant inventory. Search and sorting cover loaded records; More loads another server page of up to 25 records. The live cursor inventory is not a frozen snapshot.
Choose New automation grant to open the editor. Supply an independent personal Git access token that belongs to your current Git identity, exact branch names, exact supported workflow paths and an expiry. Golf verifies the token's immutable identity, repository access and selected files before saving. It does not silently copy your sign-in credential. Dedicated automation accounts and OAuth refresh are not supported by this slice.
The token clears immediately on submission, cancellation, page hiding or permission loss. It never appears in the inventory or receipt. Keep its provider scopes as narrow as possible: Golf's grant restrictions do not reduce the token's authority when it is used directly outside Golf.
| Restriction | Current bound |
|---|---|
| Event | Push only; no tag, merge or deployment authority |
| Branches | 1–20 unique exact names; no patterns |
| Workflow paths | 1–20 unique exact supported paths |
| Expiry at creation | More than one minute and at most 30 days away |
| Active grants | At most eight unexpired enabled grants per sponsor/repository |
| Credential replacement | Revoke the old grant and create a new one; no edit or token rotation UI |
These limits do not implement automatic fan-out, aggregate queue quotas or concurrency budgets. Archived repositories and mirrors cannot receive new grants. Their current administrators can still inspect and revoke existing delegation; cleanup authority is independent of creation eligibility.
Revoke and handle an uncertain response
Revoke asks for confirmation and submits the observed grant revision. A stale revision fails; Golf never upgrades your approval silently. Successful revocation advances the grant revision and revocation epoch and records the actor in the same database transaction. It revokes Golf delegation, not the supplied token at its provider.
If a creation or revocation response is lost or inconsistent, inspect the inventory through Refresh before making another deliberate change. The UI does not automatically resend a credential-bearing mutation. Creation has an exact-request UUID idempotency key, but replay still requires current authority and valid creation inputs; it is not an indefinite historical lookup API.
Ordinary logout and password changes invalidate sessions independently; logout after a successful grant commit does not revoke that grant. Disabling a local sponsor permanently revokes their enabled grants, and re-enabling the account does not restore them. The stopped-writer recovery primitive revokes restored enabled grants, including sponsors without a local password account. This database quarantine behavior does not qualify whole-stack encrypted backup/restore for the new grant schema.
Authorization and credential storage
Grant APIs require the current browser cookie and matching Origin. Read-only API credentials cannot list, create or revoke grants. Golf rechecks current Git owner/admin authority and immutable repository/owner identity; an instance administrator role does not impersonate repository administration. Independent Git permission changes can race local transactions, so this is not atomic authorization across both systems.
Credentials use a separate encrypted identity bound to the grant, credential version, forge and sponsor. Key availability, operator encryption rotation and retirement checks include retained revoked and expired grant credentials. Encryption rotation neither changes the token nor its logical permissions. See the authoritative automation-grant contract for lifecycle and cryptographic details.
Current qualification and next gate
Real PostgreSQL tests cover idempotency, encrypted binding, revision fencing, audit rollback, logout/restart persistence, sponsor disable/re-enable and recovery quarantine. HTTP-boundary tests cover procedure registration and cookie/Origin denial; browser fixtures cover settings behavior. Disposable native-provider qualification passed on image sha256:920308a328afaffbb4ef9ffb992691449a8fe19b509840dccd2d513ef4858557: real personal-token creation/listing, exact-request replay and changed-input denial, identity/scope/input denial, encrypted persistence through logout and restart, revision-fenced revocation with actor audit, unchanged source and zero automatic runs. All fixture resources were removed. This is grant-lifecycle evidence, not unattended execution qualification. Consult the implementation ledger for final image-specific evidence.
Push intake, independent push permission, trigger compilation and these grants are separate prerequisites. The automatic push slice has separate disposable qualification for event/commit/workflow deduplication, delegated authority, exact source, revocation and worker/result fencing. The retained schema021 local installation now has a deliberately scoped private demo. This does not establish agent integrations, notification delivery, protected merge, engine parity, Cloudflare execution or scalable runner capacity.