ADR 10: GitHub org and Infisical

backpackops org for repos, Infisical for secrets.

Status: in progress (2026-07-18). Org exists: github.com/Backpack-Ops. backpack-docs transferred. Remaining transfers blocked on the Vercel GitHub App being installed on the org.

Context

Everything lives on a personal GitHub account. Secrets sprawl across .env.local files, Vercel project envs, and GitHub Actions secrets. The Vercel CLI now issues 8-hour OAuth tokens, and every expiry broke the console until manually re-synced in three places.

Decision

Use the Backpack-Ops GitHub org (created 2026-07-18). Move console, porter, iese, docs, and all client site repos into it. Org-level Actions billing also lets the porter repo go private again (personal-account billing failure forced it public).
Adopt Infisical (workspace created under david@backpackops.com; Backpack identity stays separate from scholarfundwa.org) (open-source secrets manager, cloud free tier now, self-hostable later) as the single source of truth, syncing into Vercel envs and GitHub Actions secrets. Machine identities for agents.
Immediately: replace the CLI-derived VERCEL_TOKEN with a no-expiration personal token created in the Vercel dashboard. OAuth session tokens cannot mint durable tokens via API.

Migration notes

GitHub auto-redirects transferred repo URLs, but hardcoded “mrcoven94/” references in console (CONSOLE_REPO, registry), porter workflows, and Vercel git connections must be updated deliberately.
Do the Infisical adoption during the same migration; every secret is being touched anyway.