Research npm token renewal for CLI releases #279

New issue

Closed

opened 2026-05-11 02:02:14 +00:00 by barrettruth · 0 comments

barrettruth commented

2026-05-11 02:02:14 +00:00

Owner

Problem

The CLI release workflow publishes @barrettruth/delta through the Forgejo NPM_TOKEN Actions secret. The current npm token is short-lived and was created with an expiration date of 2026-06-09, so CLI publishing will fail unless we rotate or renew it before then.

Questions

Does npm support renewing an existing token, or must maintainers create a replacement token each time?
Can rotation be automated without introducing a more privileged long-lived credential?
Should SOPS be the source of truth for this token, with a sync step that updates the Forgejo Actions secret?
Should just release cli ... --tag check token age/expiry before pushing a release tag?

Acceptance criteria

Document the recommended renewal or rotation path.
Add any needed SOPS-to-Forgejo secret sync or manual runbook.
Add a release-time warning or preflight if manual rotation remains required.
Ensure no token values appear in Git, issues, logs, PR descriptions, or release artifacts.

## Problem The CLI release workflow publishes @barrettruth/delta through the Forgejo `NPM_TOKEN` Actions secret. The current npm token is short-lived and was created with an expiration date of 2026-06-09, so CLI publishing will fail unless we rotate or renew it before then. ## Questions - Does npm support renewing an existing token, or must maintainers create a replacement token each time? - Can rotation be automated without introducing a more privileged long-lived credential? - Should SOPS be the source of truth for this token, with a sync step that updates the Forgejo Actions secret? - Should `just release cli ... --tag` check token age/expiry before pushing a release tag? ## Acceptance criteria - Document the recommended renewal or rotation path. - Add any needed SOPS-to-Forgejo secret sync or manual runbook. - Add a release-time warning or preflight if manual rotation remains required. - Ensure no token values appear in Git, issues, logs, PR descriptions, or release artifacts.

barrettruth added the

track:infra

type:research

labels

2026-05-11 02:02:14 +00:00

barrettruth referenced this issue

2026-05-11 18:31:12 +00:00

v0.1.0 roadmap: single-user self-hosted launch #144

barrettruth referenced this issue

2026-05-11 20:07:02 +00:00

Add CLI npm token rotation guard #344

barrettruth referenced this issue from a commit