docs/infrastructure: add guide

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>

Author: threexc

docs/infrastructure.md

@@ -0,0 +1,56 @@
+# Infrastructure
+
+The [python-wheels](https://github.com/riseproject-dev/python-wheels) project
+makes use of some supplemental infrastructure available both on GitHub, and
+externally. The following sections outline these services and how to
+configure/maintain them.
+
+## RISE RISC-V Runners
+
+For RISE-hosted builds of Python wheels and upstream submissions, the
+`python-wheels` repository uses the [RISC-V
+Runners](https://riscv-runners.riseproject.dev/) project. It is already enabled
+for the repository; to reconfigure, see the [installation
+guide](https://riscv-runners.riseproject.dev/docs/getting-started/install).
+
+## GitLab
+
+The `python-wheels` project is a continuation of
+[wheel_builder](https://gitlab.com/riseproject/python/wheel_builder), which is
+hosted on GitLab. This project leverages the GitLab CI/CD framework to create
+pipelines for building, testing, and deploying wheels, along with automatic
+documentation updates and periodic checks for new package versions upstream.
+
+While development and maintenance now primarily occur on GitHub, the existing
+GitLab infrastructure (particularly the package registry) must be maintained.
+
+### GitLab for Open Source
+
+We apply for the [GitLab for Open
+Source](https://about.gitlab.com/solutions/open-source/join/) program.
+Membership requires annual renewal.
+
+### CI/CD Pipeline Tokens and Access
+
+The GitLab CI/CD pipelines make use of project tokens, generated at different
+project scopes. Two tokens are defined:
+
+1. `PYTHON_CI_GROUP_TOKEN` - Defined at the "Group"
+   ([Python](https://gitlab.com/riseproject/python)) level. Used for triggering
+   pipelines for merge requests and most automatic updates and checks. The value
+   of this token is inherited by `wheel_builder` as `PYTHON_CI_GROUP_TOKEN`
+   under `Settings -> CI/CD Settings -> Variables` (see the [CI/CD variables
+   panel](https://gitlab.com/riseproject/python/wheel_builder/-/settings/ci_cd#js-cicd-variables-settings)).
+2. `rise-github-package-registry` - Defined at the "Repository"
+   ([wheel_builder](https://gitlab.com/riseproject/python/wheel_builder/-/settings/repository#js-deploy-tokens))
+   level. Used for pushing wheels to the GitLab package registry from GitHub.
+
+These tokens are generated with a 1-year expiry timeline, so they need to be
+regenerated by a project administrator/owner.
+
+#### Token Scope Reference
+
+| Token | Level | Role | Scopes | Used For | Expiry |
+|-------|-------|------|--------|----------|--------|
+| `PYTHON_CI_GROUP_TOKEN` | Group ([Python](https://gitlab.com/riseproject/python)) | Maintainer | `api`, `read_api`, `read_repository`, `write_repository`) | MR pipeline triggers, auto updates/checks | 1 year (Unknown expiry) |
+| `rise-github-package-registry` | Repository deploy token ([wheel_builder](https://gitlab.com/riseproject/python/wheel_builder/-/settings/repository#js-deploy-tokens)) | n/a (deploy token) | `read_package_registry`, `write_package_registry`) | Push wheels GitHub → GitLab package registry | 1 year (June 29th, 2027) |