Add CLI npm token rotation guard #344

Merged

barrettruth merged 1 commit from fix/cli-npm-token-rotation-279 into main

2026-05-11 20:08:21 +00:00

barrettruth commented

2026-05-11 20:07:02 +00:00

Owner

Problem

The CLI release workflow publishes @barrettruth/delta with Forgejo Actions secret NPM_TOKEN. That npm token expires on 2026-06-09, and npm does not support renewing the existing token in place.

Solution

Document the rotation decision and runbook for the current Forgejo-based release path.
Add a SOPS-to-Forgejo sync helper that reads the encrypted token without printing it and updates NPM_TOKEN plus NPM_TOKEN_EXPIRES_AT.
Extend the CLI tag preflight to check NPM_TOKEN, read expiry metadata, and warn/block before pushing a release tag with stale token state.

Verification

bash -n scripts/version/bump.sh scripts/version/sync-npm-token-from-sops.sh
git diff --check
nix shell nixpkgs#sops -c sh -c 'sops -d --extract '''["data"]''' "$HOME/.config/nix/secrets/vps/forgejo-action-delta-npm-token" | wc -c'
direnv exec . nix develop --command just ci

Refs #279

## Problem The CLI release workflow publishes @barrettruth/delta with Forgejo Actions secret NPM_TOKEN. That npm token expires on 2026-06-09, and npm does not support renewing the existing token in place. ## Solution - Document the rotation decision and runbook for the current Forgejo-based release path. - Add a SOPS-to-Forgejo sync helper that reads the encrypted token without printing it and updates NPM_TOKEN plus NPM_TOKEN_EXPIRES_AT. - Extend the CLI tag preflight to check NPM_TOKEN, read expiry metadata, and warn/block before pushing a release tag with stale token state. ## Verification - bash -n scripts/version/bump.sh scripts/version/sync-npm-token-from-sops.sh - git diff --check - nix shell nixpkgs#sops -c sh -c 'sops -d --extract '\''["data"]'\'' "$HOME/.config/nix/secrets/vps/forgejo-action-delta-npm-token" | wc -c' - direnv exec . nix develop --command just ci Refs #279

barrettruth added 1 commit

2026-05-11 20:07:02 +00:00

Add CLI npm token rotation guard

quality / Test (pull_request) Successful in 15s

Details

quality / Lint (pull_request) Successful in 21s

Details

quality / Build (pull_request) Successful in 42s

Details

58edee2c9e