pah-link-aaplisted

Point this environment's AAP project syncs at its own Private Automation Hub, so collections resolve from the curated `approved` repository instead of the internet. Mints a read-scoped gateway token from credentials the environment already holds, creates the Galaxy credential, assigns it to the organization, and proves it with a real project sync. Fully reversible. TRIGGER when: the user asks to point AAP at PAH, wants project syncs to resolve from the hub, asks why a populated hub is not being used, wants organization Galaxy credentials, asks about issue #69, or wants to undo that link. SKIP: if the hub is empty or has not been populated and curated yet — that is pah-sync — or if the user wants to mirror the execution environment image, which is sales-demos-ee-build.
ericcames/sales.demos · ★ 1 · DevOps & Infrastructure · score 67

Install: claude install-skill ericcames/sales.demos

# pah-link-aap Closes [#69](https://github.com/ericcames/sales.demos/issues/69). The hub is populated by [`pah-sync`](../pah-sync/SKILL.md) and curated by `curate_hub.yml`; until this runs, **nothing points at it**. This skill contains **no logic**. The work is [`playbooks/link_hub.yml`](../../../playbooks/link_hub.yml). ## What it does, and what it risks Creates a `Sales Demos - PAH Galaxy` credential aimed at `https://<aap_hostname>/api/galaxy/content/approved/` and assigns it to the `IT Service Automation` organization. **A Galaxy credential on the organization makes EVERY project sync in it resolve from PAH.** If `approved` is short one collection, the sync fails and every job template fails with it. Say that out loud before running this in front of anyone. Three things bound it: | Bound | Where | |---|---| | Refuses to link an empty `approved` | the playbook, before it mints anything | | Reversal proven, not just written | `-e hub_galaxy_link_state=absent` | | `sandbox` before `demo` | your discipline, not the code | ## One distribution, not four `approved` only. Not the three mirrors as fallbacks, and not public Galaxy. The mirrors' contents are decided by Red Hat and the community; `approved`'s are declared in `hub/approved-collections.yml`. Pointing at a mirror "just in case" gives up the only claim this use case makes — *your teams install what you approved* — in exchange for hiding the failure this playbook is designed to surface. ## The token is a gatewa