feat(secrets): monthly expiry report workflow and the manifest facts the repo knows (P8, 3/3; stacked on #99) #100
Loading…
Reference in a new issue
No description provided.
Delete branch "jfraeys/feat/secrets-expiry-workflow"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Merge #98, then #99, then this (stacked; until then the diff also shows their commits).
Delivery for the P8 expiry report.
.forgejo/workflows/secrets-expiry.yml: runs on the 1st of each month and on workflow_dispatch. Reads only the manifest (no values, no decryption), keeps ONE issue titledSecrets expiry report YYYY-MMup to date, and fails the run when a secret is expired or overdue. Approaching and unknown entries go in the issue but never fail the run. Uses the existing CI_FORGEJO_COMMENT_TOKEN (the manifest already describes it as able to open issues); without the token it warns and still evaluates the exit code.scripts/forgejo-upsert-issue.py(stdlib only): creates or updates the open issue with an exact title; the token comes from the environment and is never printed. 5 tests against a local mock of the Forgejo issues API (create then update the same issue, a different month is a new issue, only an exact title matches, the token is sent but never printed, a missing token fails before any API call), added to the lint workflow with the expiry tests (17 pass).rotated YYYY-MM-DD; no expiry and no rotation schedule recorded(still unknown).HEADSCALE_API_KEYexpiry 2027-01-09 and rotated_at 2026-10-11 (read fromheadscale apikeys liston services: prefixes and dates only);AUTHELIA_OIDC_PRIVATE_KEY_PEMandCI_EPHEMERAL_ANSIBLE_SSH_KEYrotated_at 2026-10-10 (the rotation commit in #52) and their exposure text updated. Nothing invented: the report now reads expired=0 overdue=0 approaching=0 unknown=48 documented=1 ok=13.What 48 unknown means: most manifest entries have no real expiry or rotation date because nobody has recorded one (for tokens that is a provider-console lookup). That is a data gap for you, not something to guess; the report keeps listing it until it is closed.
After merge, run it once by hand (Actions > Secrets Expiry > Run workflow) to confirm the issue is created; it has not run on a real runner yet.
🤖 Generated with Claude Code