Auto-rotate the coilyco-ops bot creds + source CI/registry token from the rotating value (unblocks aos#223, ward#181) #383

New issue

Open

opened 2026-06-19 09:57:14 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-06-19 09:57:14 +00:00

Member

Why

agentic-os#223 (bake ward into the dev-base image) needs CI to authenticate to the Forgejo registry and read a private repo asset as the coilyco-ops bot, not a personal PAT. Wiring publish-image to log in as coilyco-ops failed because the only available token is a static REGISTRY_TOKEN Actions secret holding the coilysiren PAT. The fix is not "paste the bot PAT into a static secret" - bot creds should auto-rotate, and CI should source the current value.

Current state

The coilyco-ops bot API token already lives in SSM: /forgejo/coilyco-ops/api-token (read by ward cmd/ward/forgejo_issue.go); the git-push token is at /forgejo/api-token.
The agentic-os Actions workflows (runs-on: docker) have no AWS/SSM access wired - zero aws usage today. So a workflow cannot resolve the SSM token at runtime yet.

Scope

Rotation. Mint a fresh coilyco-ops Forgejo PAT on a schedule (ansible role / cron), write it to /forgejo/coilyco-ops/api-token (SecureString), revoke the prior. Scopes the bot needs: write:package (push images), repo read (clone/fetch private assets), plus whatever the existing agent push token needs. (Relates to the bot org-membership gap in infrastructure#382 - a bot with no membership cannot read org repos.)
CI sourcing (pick one).
- a. Give the docker Actions runner AWS read access and resolve the token in-workflow (aws ssm get-parameter /forgejo/coilyco-ops/api-token), so every run uses the current value. Preferred - no secret to drift.
- b. A rotation step also writes the fresh PAT into the Forgejo Actions secret REGISTRY_TOKEN on each rotation (sync job).

Unblocks

agentic-os#223 - bake ward via bot creds (reverted to green for now; the bake + bot-login change is held on the issue-223 branch to re-land once this lands).
ward#181 - rewrite entrypoint.sh into Go (needs the baked-ward image).

## Why `agentic-os#223` (bake ward into the dev-base image) needs CI to authenticate to the Forgejo registry **and** read a private repo asset as the **coilyco-ops bot**, not a personal PAT. Wiring `publish-image` to log in as `coilyco-ops` failed because the only available token is a **static** `REGISTRY_TOKEN` Actions secret holding the `coilysiren` PAT. The fix is not "paste the bot PAT into a static secret" - bot creds should **auto-rotate**, and CI should source the current value. ## Current state - The coilyco-ops bot API token already lives in SSM: **`/forgejo/coilyco-ops/api-token`** (read by ward `cmd/ward/forgejo_issue.go`); the git-push token is at `/forgejo/api-token`. - The agentic-os Actions workflows (`runs-on: docker`) have **no AWS/SSM access** wired - zero `aws` usage today. So a workflow cannot resolve the SSM token at runtime yet. ## Scope 1. **Rotation.** Mint a fresh coilyco-ops Forgejo PAT on a schedule (ansible role / cron), write it to `/forgejo/coilyco-ops/api-token` (SecureString), revoke the prior. Scopes the bot needs: `write:package` (push images), `repo` read (clone/fetch private assets), plus whatever the existing agent push token needs. (Relates to the bot org-membership gap in infrastructure#382 - a bot with no membership cannot read org repos.) 2. **CI sourcing (pick one).** - **a.** Give the `docker` Actions runner AWS read access and resolve the token in-workflow (`aws ssm get-parameter /forgejo/coilyco-ops/api-token`), so every run uses the current value. Preferred - no secret to drift. - **b.** A rotation step also writes the fresh PAT into the Forgejo Actions secret `REGISTRY_TOKEN` on each rotation (sync job). ## Unblocks - **agentic-os#223** - bake ward via bot creds (reverted to green for now; the bake + bot-login change is held on the `issue-223` branch to re-land once this lands). - **ward#181** - rewrite entrypoint.sh into Go (needs the baked-ward image).

coilyco-ops referenced this issue

2026-06-19 11:03:22 +00:00

Rebuild Forgejo PATs under the coilyco-ops bot (after the token wipe) #384

coilyco-ops added the

consult

labels

2026-06-24 05:38:23 +00:00

coilyco-ops commented

2026-06-24 05:38:24 +00:00

Author

Member

Triage: P2 / consult - Auto-rotate bot creds; depends on the #384 manual rebuild and is design-heavy.

(goose-style pass; claude as the judgment engine, applied 2026-06-23)

**Triage:** `P2` / `consult` - Auto-rotate bot creds; depends on the #384 manual rebuild and is design-heavy. (goose-style pass; claude as the judgment engine, applied 2026-06-23)

coilyco-ops added

interactive

and removed

consult

labels

2026-07-09 21:46:26 +00:00

coilyco-ops added

consult

and removed

interactive

labels

2026-07-10 09:00:05 +00:00