feat(ci): rotation scripts keep the Forgejo secret replicas current #44

Merged

jfraeys merged 2 commits from jfraeys/feat/rotation-ci-sync into main

2026-10-10 11:08:22 -04:00

jfraeys commented

2026-10-10 11:01:17 -04:00

Owner

Wires the P5 sync into rotation, so a rotation updates the vault and the Forgejo replicas in one step.

Stacked on #43 (it adds .forgejo/ci-secrets.yml and scripts/sync-ci-secrets.py): merge #43 first; until then this diff also shows its commit.

sync-ci-secrets.py --vault-key KEY...: only the Forgejo secrets replicating those vault keys; exits 0 doing nothing if none do.
rotate-secret.sh: records every key it changes (including the Authelia/Headscale paired keys) and syncs them after the vault write. Sync failure after a successful vault write: prints "Forgejo CI secret ... is STALE" plus the fix command, still prints the rest of the output, exits 1.
rotate-ovh-s3-credentials.sh: same for its pair.
provision-ci-state-key.py: replaced its own Forgejo PUT/verify code with the shared sync (less duplication).

Today none of the rotated keys is replicated (the replicated vault keys are TF_VAR_linode_token, TF_VAR_cloudflare_api_token, FORGEJO_ADMIN_TOKEN, CI_STATE_BACKEND_*, and rotate-secret.sh does not touch them), so the hook is a no-op for current rotations; it takes effect when those are rotated.

Verified: syntax of all touched scripts; --vault-key no-op and mapped-key paths against the real repo (read-only/no-op only); rotate-secret.sh headscale --dry-run still runs and leaves the vault untouched. Not verified: a real rotation or a real sync failure through rotate-secret.sh (would change real secrets).

🤖 Generated with Claude Code

Wires the P5 sync into rotation, so a rotation updates the vault and the Forgejo replicas in one step. **Stacked on #43** (it adds .forgejo/ci-secrets.yml and scripts/sync-ci-secrets.py): merge #43 first; until then this diff also shows its commit. - `sync-ci-secrets.py --vault-key KEY...`: only the Forgejo secrets replicating those vault keys; exits 0 doing nothing if none do. - `rotate-secret.sh`: records every key it changes (including the Authelia/Headscale paired keys) and syncs them after the vault write. Sync failure after a successful vault write: prints "Forgejo CI secret ... is STALE" plus the fix command, still prints the rest of the output, exits 1. - `rotate-ovh-s3-credentials.sh`: same for its pair. - `provision-ci-state-key.py`: replaced its own Forgejo PUT/verify code with the shared sync (less duplication). **Today none of the rotated keys is replicated** (the replicated vault keys are TF_VAR_linode_token, TF_VAR_cloudflare_api_token, FORGEJO_ADMIN_TOKEN, CI_STATE_BACKEND_*, and rotate-secret.sh does not touch them), so the hook is a no-op for current rotations; it takes effect when those are rotated. Verified: syntax of all touched scripts; `--vault-key` no-op and mapped-key paths against the real repo (read-only/no-op only); `rotate-secret.sh headscale --dry-run` still runs and leaves the vault untouched. Not verified: a real rotation or a real sync failure through rotate-secret.sh (would change real secrets). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 2 commits

2026-10-10 11:01:17 -04:00

feat(ci): P5 - declare CI secrets as vault replicas and sync them; drop BW_SESSION

Lint / lint (pull_request) Successful in 1m8s

Details

dd10a6eb32

.forgejo/ci-secrets.yml maps each Forgejo repo secret to the vault key it
replicates; scripts/sync-ci-secrets.py checks (default, read-only) or writes
them (--apply, --force, --only), reports names and statuses only and exits
nonzero on any failure. Tested against the real repo with a throwaway
non-secret secret (good key written, missing vault key reported, rerun skipped,
--force rewrote, deleted afterwards). BW_SESSION is removed from the two
workflows that referenced it. README and a restore runbook updated.

Not applied: LINODE_TOKEN, CLOUDFLARE_API_TOKEN, FORGEJO_ADMIN_TOKEN are still
missing as repo secrets; writing them is a separate decision.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

feat(ci): rotation scripts keep the Forgejo secret replicas current

Lint / lint (pull_request) Successful in 1m33s

Details

629bffb57c

sync-ci-secrets.py gains --vault-key (sync only the secrets replicating the
given vault keys; a no-op if none do). rotate-secret.sh records every key it
changes and syncs those; rotate-ovh-s3-credentials.sh does the same for its
pair; provision-ci-state-key.py drops its own Forgejo write code for the shared
sync. If the vault write succeeds but the sync fails, the script reports the
replica as STALE, prints the fix and exits nonzero. Stacked on the P5 PR.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit edd8e609d9 into main

2026-10-10 11:08:22 -04:00

jfraeys referenced this pull request from a commit

2026-10-10 11:08:24 -04:00

Merge pull request 'feat(ci): rotation scripts keep the Forgejo secret replicas current' (#44) from jfraeys/feat/rotation-ci-sync into main

jfraeys referenced this pull request

2026-10-10 11:14:11 -04:00

fix(ci): rename the FORGEJO_ADMIN_TOKEN Forgejo secret to CI_FORGEJO_ADMIN_TOKEN #45