Make registry PAT rotation transactional and revoke failed-mint orphans #686

New issue

Open

opened 2026-07-29 06:52:40 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-29 06:52:40 +00:00

Owner

Outcome

Revoke the unused coilyco-ops PATs registry-publish-20260728234440 and registry-publish-20260728234554, then make registry-token-provision --rotate revoke a newly minted token automatically when SSM persistence fails.

Evidence

During infrastructure#685, both tokens were minted before the provisioner hit retired or unsupported SSM command arguments. Neither value reached SSM or an Actions secret. The successful replacement token was minted later, stored at /forgejo/coilyco-ops/registry-token, verified for registry write scope, and synced to the organization secret.

Acceptance

An approved guarded operator surface revokes both exact unused token names without touching the installed registry credential.
A failed pre-persistence rotation leaves no live orphan token.
The provisioner keeps token values out of argv, output, and tracked files.
Ward validation and the complete hook suite pass.

## Outcome Revoke the unused `coilyco-ops` PATs `registry-publish-20260728234440` and `registry-publish-20260728234554`, then make `registry-token-provision --rotate` revoke a newly minted token automatically when SSM persistence fails. ## Evidence During infrastructure#685, both tokens were minted before the provisioner hit retired or unsupported SSM command arguments. Neither value reached SSM or an Actions secret. The successful replacement token was minted later, stored at `/forgejo/coilyco-ops/registry-token`, verified for registry write scope, and synced to the organization secret. ## Acceptance * An approved guarded operator surface revokes both exact unused token names without touching the installed registry credential. * A failed pre-persistence rotation leaves no live orphan token. * The provisioner keeps token values out of argv, output, and tracked files. * Ward validation and the complete hook suite pass.

coilyco-ops added the

priority

autonomy

live-collab

labels

2026-08-05 10:25:57 +00:00

coilyco-ops added the

role/sysadmin

label

2026-08-25 08:02:19 +00:00

coilyco-ops added this to the Credentials and access milestone

2026-08-29 06:09:57 +00:00