GitLab CI/CD Variables Audit & Migration Plan¶
Objective¶
Move all Bluefly CI/CD variables from project-level to group-level (blueflyio org).
Create authoritative catalogue entry documenting all variables with masking pattern.
No secrets exposed; values represented as [first-4]...[last-4] or [SET] for safety.
Current State (Verified 2026-09-23)¶
Source: GitLab API queries against namespace 87749026 (blueflyio).
Estate Topology¶
| Metric | Count |
|---|---|
| Total projects | 188 |
| Active projects | 131 |
| Archived projects | 57 |
| Empty repos | 2 |
| Subgroups | 14 |
| Group members | 16 (6 billable) |
| LFS enabled | 188/188 |
| Container registry enabled | 187/188 |
| Packages enabled | 186/188 |
Subscription¶
| Field | Value |
|---|---|
| Plan | Ultimate (SaaS, GitLab.com) |
| Subscription ID | A-S00141074 |
| Period | 2025-12-19 → 2026-12-19 |
| Auto-renew | false |
| Seats licensed | 25 |
| Seats in use | 6 |
| Trial ended | 2024-12-09 |
Runners¶
| ID | Description | Status | Type | Tags |
|---|---|---|---|---|
| 55976922 | oracle-docker-1 (STALE — tokens expired, re-registered as 56646930) | offline | group_type | oracle-docker,oracle-deploy,oracle-shell,saas-linux-small-amd64 |
| 56646930 | oracle-docker-1 | online | group_type | (inherited from registration) |
Plus ~60 GitLab SaaS instance runners (saas-linux-small-amd64, shared-gitlab-org, etc.) — not Bluefly-owned.
Deploy Tokens¶
| Name | Status | Scopes |
|---|---|---|
| packageist | revoked | read_repository, read/write_registry, read/write_package_registry |
| BLUEFLY_DEVOPS_TOKEN | revoked | read_repository, read/write_registry, read/write_package_registry |
| BLUEFLY_COMPONENT_TOKEN | revoked | read_repository, read/write_registry, read/write_package_registry |
| BLUEFLY_IMAGE_TOKEN | revoked | read_repository, read/write_registry, read/write_package_registry |
| k3s-oracle-registry-20260419 | active | read_registry |
| k3s-oracle-full-20260419 | active | read_repository, read_registry |
| oracle-k3s-full-20260419 | active | read_repository, read_registry |
Group Access Tokens¶
2 group access tokens (service accounts). Details in API — no values exposed.
Group Webhooks¶
1 group webhook configured.
Group-Level Variables (100 — was 20 on 2026-08-11)¶
Infrastructure & SSH (8)¶
NAS_BASE, NAS_BLUEFLY_USER, NAS_HOST, NAS_IP, NAS_ROOT_USER, NAS_SSH_KEY
ORACLE_HOST, ORACLE_SSH_KEY, ORACLE_USER
GitLab Service Account Tokens (GITLAB_TOKEN_*) (12)¶
GITLAB_TOKEN_CLUSTER_OPERATOR
GITLAB_TOKEN_CODE_QUALITY_REVIEWER
GITLAB_TOKEN_COST_INTELLIGENCE_MONITOR
GITLAB_TOKEN_DOCUMENTATION_AGGREGATOR
GITLAB_TOKEN_DRUPAL_STANDARDS_ENFORCER
GITLAB_TOKEN_ISSUE_LIFECYCLE_MANAGER
GITLAB_TOKEN_KAGENT_CATALOG_SYNC
GITLAB_TOKEN_MANIFEST_VALIDATOR
GITLAB_TOKEN_MCP_SERVER_BUILDER
GITLAB_TOKEN_MERGE_REQUEST_REVIEWER
GITLAB_TOKEN_MODULE_GENERATOR
GITLAB_TOKEN_PIPELINE_REMEDIATION
GITLAB_TOKEN_RECIPE_PUBLISHER
GITLAB_TOKEN_RELEASE_COORDINATOR
GITLAB_TOKEN_TASK_DISPATCHER
GITLAB_TOKEN_VULNERABILITY_SCANNER
GITLAB_TOKEN_WEBHOOK_MANAGER
GitLab Service Account Tokens (SA_TOKEN_*) (12)¶
SA_TOKEN_CLUSTER_OPERATOR
SA_TOKEN_CODE_QUALITY_REVIEWER
SA_TOKEN_COST_INTELLIGENCE_MONITOR
SA_TOKEN_DOCUMENTATION_AGGREGATOR
SA_TOKEN_DRUPAL_STANDARDS_CHECKER
SA_TOKEN_ISSUE_LIFECYCLE_MANAGER
SA_TOKEN_KAGENT_CATALOG_SYNC
SA_TOKEN_MCP_SERVER_BUILDER
SA_TOKEN_MODULE_GENERATOR
SA_TOKEN_MR_REVIEWER
SA_TOKEN_OSSA_VALIDATOR
SA_TOKEN_PIPELINE_REMEDIATION
SA_TOKEN_RECIPE_PUBLISHER
SA_TOKEN_RELEASE_COORDINATOR
SA_TOKEN_TASK_DISPATCHER
SA_TOKEN_VULNERABILITY_SCANNER
GitLab Bot Tokens (GITLAB_BOT_*) (8)¶
GITLAB_BOT_CI_TOKEN, GITLAB_BOT_DEV_TOKEN, GITLAB_BOT_DRUPAL_TOKEN
GITLAB_BOT_DUO_CLI, GITLAB_BOT_MR_REVIEWER, GITLAB_BOT_OSSA_TOKEN
GITLAB_BOT_TS_TOKEN, GITLAB_BOT_WIKI_AGGREGATOR
Legacy Service Account Tokens (4)¶
SERVICE_ACCOUNT_DEPLOYMENT_TOKEN
SERVICE_ACCOUNT_MONITORING_TOKEN
SERVICE_ACCOUNT_SECURITY_TOKEN
SERVICE_ACCOUNT_VERSION_MANAGER_TOKEN
AI/ML API Keys (4)¶
DEEPSEEK_API_KEY, MISTRAL_API_KEY, OPENAI_API_KEY, DUO_MODEL
CI/CD Configuration (6)¶
BUILD_RUNNER_TAG (=oracle-docker)
CI_GITLAB_COMPONENTS, CI_USE_LOCAL_RUNNERS
GITLAB_COMPONENTS_VERSION, GOLDEN_COMPONENT_VERSION
GITLAB_GROUP_ID
Platform & Integration (remaining)¶
AGENT_BRAIN_URL, AGENT_MESH_API_KEY, AGENT_MESH_URL
AGENT_PROTOCOL_URL, AGENT_REGISTRY_URL, AGENT_WEBHOOK_TOKEN
BLUEFLY_DEVOPS_USER, CLOUDFLARE_TUNNEL_OSSA
DEPLOY_DRUPALORG_TOKEN, DISCORD_CHANNEL_URL, DISCORD_SERVER_ID, DISCORD_WEBHOOK_URL
DRUPALORG_PROJTOKEN_api_normalization, DRUPAL_ORG_SSH_KEY, DRUPAL_SIMPLE_VERSION
GH_TOKEN, GITLAB_AGENTNAS, GITLAB_OBSERVABILITY_TOKEN
GITLAB_REGISTRY_NPM_TOKEN, GITLAB_TOKEN
KUBECONFIG_DEV, KUBECONFIG_LOCAL, KUBECONFIG_PROD
NEO4J_ENABLED, NEO4J_PASSWORD, NEO4J_URI, NEO4J_USER
OSSA_NPMJS, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS
SIGNOZ_API_KEY, SLACK_CHANNEL_ID, SLACK_WEBHOOK_URL, SSH_KEY
USE_AGENT_MESH, WIKI_BASE, WORKTREE_BASE
Project-Level Variables (39 projects, ~100 total vars)¶
| Project | Vars |
|---|---|
| agent-docker | 9 |
| iac | 9 |
| bluefly (assets) | 9 |
| openstandardagents.org | 11 |
| openstandardagents | 8 |
| agentdev | 6 |
| agents (agentictools) | 6 |
| demo_agentdash | 4 |
| cim | 4 |
| node-agent-marketplace | 4 |
| a2a-collector | 3 |
| agentblu.ai | 3 |
| cedar_policy | 3 |
| agent-brain, agent-mesh, agent-protocol, agent-router, agent-tracer, compliance-engine, contractplane.ai-website, dragonfly, blu-cli, blu-worker | 2 each |
| 15 projects | 1 each |
Problem Statement¶
- Variable sprawl: 100 group vars (up from 20 on Aug 11) — 5x growth in 6 weeks
- Token proliferation: 12
GITLAB_TOKEN_*+ 12SA_TOKEN_*+ 8GITLAB_BOT_*+ 4 legacySERVICE_ACCOUNT_*= 36 tokens - Forgejo migration coupling: All 36 GitLab-specific tokens become dead weight on Forgejo cutover
- 39 projects with local overrides — inheritance not fully adopted
- 4 revoked deploy tokens still registered (cleanup needed)
- Stale runner #55976922 still registered with expired tokens
Target State¶
- All CI/CD variables defined at
blueflyiogroup level - Projects inherit group variables automatically
- No project-level variable overrides unless explicitly justified
- Token consolidation: reduce 36 GitLab-specific tokens before Forgejo migration
- Revoked deploy tokens deleted
- Stale runner removed
- Authoritative catalogue in
catalog/ci-cd-variables.md
Migration Plan¶
Phase 1: Audit (COMPLETE — 2026-09-23)¶
Machine-readable inventory produced via GitLab API. All JSON artifacts in Scratch/bc-or8m/.
Phase 2: Catalogue Creation¶
File: catalog/ci-cd-variables.md (update existing or create)
Phase 3: Cleanup & Migration (Requires Approval)¶
- Delete 4 revoked deploy tokens
- Delete stale runner #55976922
- Consolidate duplicate token patterns (
GITLAB_TOKEN_*vsSA_TOKEN_*) - Migrate justified project-level vars to group level
- Document remaining project-specific exceptions
Forgejo Exit Relevance¶
This inventory directly feeds the GitLab exit strategy (bc-kfsv). The 100 group variables and 36 GitLab-specific tokens represent the coupling surface that must be addressed before cutover. The subscription (Ultimate SaaS, expires 2026-12-19, auto_renew=false) sets the hard deadline.
Plan Status: Phase 1 complete. Phase 2–3 pending approval.
Last verified: 2026-09-23 via glab api (GitLab REST API)
Bead: bc-or8m