Mint registry read token under coilyco-ops SSM path #515

New issue

Open

opened 2026-07-14 06:13:15 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-14 06:13:15 +00:00

Member

Run scripts/rotate-registry-read-token.sh from an ops or director surface, then verify:

ward ops aws ssm get-parameter --name /forgejo/coilyco-ops/registry-read-token --with-decryption --query Parameter.Value --output text succeeds with output discarded.
printf forgejo.coilysiren.me through scripts/docker-credential-forgejo-ssm get exits 0 without the fallback warning.
docker pull forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:release still succeeds.

Follow-up from #514. The Docker helper now looks for the least-privilege registry read token at /forgejo/coilyco-ops/registry-read-token. That path is currently absent, so pulls work through the bot-owned registry publish-token fallback and print a warning. Run scripts/rotate-registry-read-token.sh from an ops or director surface, then verify: * ward ops aws ssm get-parameter --name /forgejo/coilyco-ops/registry-read-token --with-decryption --query Parameter.Value --output text succeeds with output discarded. * printf forgejo.coilysiren.me through scripts/docker-credential-forgejo-ssm get exits 0 without the fallback warning. * docker pull forgejo.coilysiren.me/coilyco-flight-deck/agentic-os:release still succeeds.

coilyco-ops added the

consult

labels

2026-07-14 07:44:04 +00:00