Seven tools, four flows. Each flow is one row in the table, and one Steps block.The tools page lists what each one does. This page shows how they connect. Read the table first; the Steps below it expand each flow.
The flows at a glance
CI Tier 1 — Doppler distributes via secrets-sync
CI Tier 2 — infra fetches at runtime
The high-sensitivity Doppler config (database passwords, RunsOn license, Qdrant keys) never sits in GitHub Actions secrets. The job fetches at runtime via the read-only service token distributed by Tier 1.OpenTofu — Terrakube → OpenBao
Local AI session — mint on demand, store nothing
See Local AI isolation for the diagram and the full proof. Short version: no GitHub token sits on the workstation. Each request mints a short-lived, scoped token that lives in memory for that operation and is never written to disk.git and gh reach that mint
by different routes: git through a credential helper, gh through a shell wrapper. gh
reads a token from the environment and never consults git’s credential helpers. Write access needs
an explicit claim on one named repository.
Where each flow is documented
- CI Tier 1: secrets-sync
- CI Tier 2: doppler
- OpenTofu: OpenBao + IaC tooling
- Local AI session: local-ai-isolation + GitHub access
- Encrypted config: sops