Revoke GH Actions tailnet credentials after rip-out sweep #160
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
Following the rip-out of Tailscale + K3s steps from GitHub Actions across
repo-recall,personal-dashboard,backend,galaxy-gen,eco-jobs-tracker,eco-mcp-app, the GH-side secrets and the per-repo federated identities still exist. Until they're revoked, a re-added workflow (or anyone withsecretsaccess) could still call into the tailnet / cluster.Per-repo rip-out tracking:
Proposal
gh secret delete --repo coilysiren/<repo> <NAME>:TS_CLIENT_ID,TS_AUDIENCE,TS_OAUTH_CLIENT_ID,TS_OAUTH_SECRET(subset varies per repo; safe to delete-if-exists).K8S_SERVER,K8S_CA_DATA,K8S_CLIENT_CERT_DATA,K8S_CLIENT_KEY_DATA.DATASTORE_TOKENif no other workflow still uses it.terraform/tailscale-oidc/(and any sibling tags-only OAuth client used by personal-dashboard / eco-* / backend OIDC).terraform planshould show the targeted destroys; apply once reviewed.Acceptance
gh secret list --repo coilysiren/<repo>shows none of the names above for the six repos.terraform planinterraform/tailscale-oidc/shows no drift after the destroy lands.github-actions-*hostname /tag:ci-only client.Out of scope
Halt check before revocation. Audited the six repos' workflows on GitHub and only
repo-recallis actually clean. The other five still have live references to the secrets this issue proposes deleting:TS_*/K8S_*/DATASTORE_TOKEN. Safe to revokeTS_AUDIENCE,TS_CLIENT_IDand remove fromterraform/tailscale/repos.yaml..github/workflows/release.yml:129usestailscale/github-action@v3+TS_OAUTH_CLIENT_ID/TS_OAUTH_SECRETto triggerpersonal-dashboard-update.serviceon kai-server. Deleting would break releases. Note: the per-repo tracking #10 is listed as "landed" in #160 but the workflow disagrees.build-and-publish.ymlusesTS_CLIENT_ID,TS_AUDIENCE,DATASTORE_TOKEN.build-and-publish.ymlusesTS_CLIENT_ID,TS_AUDIENCE.build-and-publish.ymlusesTS_OAUTH_CLIENT_ID,TS_OAUTH_SECRET,K8S_SERVER,K8S_CA_DATA,K8S_CLIENT_CERT_DATA,K8S_CLIENT_KEY_DATA.build-and-publish.ymlusesTS_OAUTH_CLIENT_ID,TS_OAUTH_SECRET,K8S_SERVER,K8S_CA_DATA,K8S_CLIENT_CERT_DATA,K8S_CLIENT_KEY_DATA.Suggested next steps:
repo-recallnow (delete its two GH secrets, dropcoilysiren/repo-recallfromterraform/tailscale/repos.yaml,terraform applydestroys the federated identity).build-and-publish.yml/release.ymlactually rips the tailnet/K3s step. Re-audit and revoke per-repo as each lands.No code changes pushed from this session. Holding for direction.