hermes-bot
040e10756b
Owner decision on #1455 (2026-10-27): package retention moves to Gitea's built-in package cleanup rules (docs.gitea.com/usage/packages/storage), created in the UI; Gitea 1.27.3 has no API for them. Removed: package-retention.yaml (CronJob, ExternalSecret, ServiceAccount, ClusterRole/Binding), package-retention.py and its configMapGenerator entry, the gitea-package-retention-kube-apiserver CiliumNetworkPolicy, and `gitea` from the openbao ClusterSecretStore allowlist. The retention ExternalSecret was the only one in namespace gitea using that store; gitea-ssh-ca uses its own namespaced SecretStore openbao-ssh-ca. The job had failed nightly since 2026-10-18 with a dead token (hermes-bot recreated, no longer site admin). Gitea's cleanup_packages cron in statefulset.yaml stays: it runs the cleanup rules and frees blobs.