allod/secrets
Watch
2
0
Fork
You've already forked secrets
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Rename the rotation registry: forgejo-token-groups.json and lib.forgejoTokenGroups no longer say what they hold #22

New issue
Closed
opened 2026-09-11 05:51:31 +01:00 by vnprc-agent · 2 comments
vnprc-agent commented 2026-09-11 05:51:31 +01:00
Copy link

Rename the rotation registry from forgejo-token-groups.json and lib.forgejoTokenGroups to a name that says what it holds now, since service can be none and the last two credentials registered there are not Forgejo tokens at all.

Primary goals:

  • A name for what it is — the file and the flake export describe a credential rotation registry, not Forgejo token groups; a rotation-registry.json and lib.rotationRegistry shape, or whatever the owner prefers, replaces both.
  • Every consumer moves together — allod/archetypes reads the export for credentials[] and local_auth_refresh, allod/nexus rotate-token reads it for group selection and validation, and allod/tools reads it in allod secret create, rekey, rotate, and declare; the rename lands as one ordered set of PRs with a compatibility window or a single flag day, decided here.
  • Docs and README follow — this repository's README, the nexus credentials doc, and allod/tools docs/allod-secret.md name the file.

Current state and specifics

allod/tools#182 generalized the registry in place (service became forgejo or none) and deferred the rename because it is cross-repo. allod/tools#197 moves value rotation into allod secret rotate and, per its design decision, leaves the names unchanged so that PR stays single-repo; it reads the registry through the same nixEvalTokenGroups seam create and rekey use, so the tools side of a rename is one attribute name and one file name.

Scope

In: the file and export rename in this repository, the consumer updates in archetypes, nexus, and tools, and the landing order. Out: any change to the registry's shape or validation.

Rename the rotation registry from `forgejo-token-groups.json` and `lib.forgejoTokenGroups` to a name that says what it holds now, since `service` can be `none` and the last two credentials registered there are not Forgejo tokens at all. Primary goals: - **A name for what it is** — the file and the flake export describe a credential rotation registry, not Forgejo token groups; a `rotation-registry.json` and `lib.rotationRegistry` shape, or whatever the owner prefers, replaces both. - **Every consumer moves together** — `allod/archetypes` reads the export for `credentials[]` and `local_auth_refresh`, `allod/nexus` `rotate-token` reads it for group selection and validation, and `allod/tools` reads it in `allod secret create`, `rekey`, `rotate`, and `declare`; the rename lands as one ordered set of PRs with a compatibility window or a single flag day, decided here. - **Docs and README follow** — this repository's README, the nexus credentials doc, and `allod/tools` `docs/allod-secret.md` name the file. ### Current state and specifics allod/tools#182 generalized the registry in place (`service` became `forgejo` or `none`) and deferred the rename because it is cross-repo. allod/tools#197 moves value rotation into `allod secret rotate` and, per its design decision, leaves the names unchanged so that PR stays single-repo; it reads the registry through the same `nixEvalTokenGroups` seam `create` and `rekey` use, so the tools side of a rename is one attribute name and one file name. ### Scope In: the file and export rename in this repository, the consumer updates in archetypes, nexus, and tools, and the landing order. Out: any change to the registry's shape or validation.
allod-agent commented 2026-09-19 18:46:15 +01:00
Member
Copy link

Decision for the rename, recorded here as the issue asks.

Names: the file becomes rotation-registry.json and the flake export becomes lib.rotationRegistry. Human-facing text calls it the credential rotation registry.

Compatibility window rather than a flag day for the export: the first secrets PR renames the file, exports lib.rotationRegistry, and keeps lib.forgejoTokenGroups as a deprecated alias of the same validated value, so a deploy lock cascade that advances secrets before archetypes keeps evaluating. The file name is a flag day for allod secret declare, which opens the file by name, so tools lands right after secrets.

Landing order:

  1. allod/secrets: rename plus alias (Refs).
  2. allod/tools, allod/nexus, allod/archetypes in any order, each reading lib.rotationRegistry with no fallback to the old name. The archetypes PR bumps its secrets lock to the merged secrets commit before it merges. allod/memory's age.md follows as a docs-only PR.
  3. allod/deploy: the lock cascade advances secrets before archetypes.
  4. allod/secrets: remove the alias (Closes this issue) once every consumer above has landed and deploy's lock has moved.

A deployment's private fork of allod/secrets must merge the rename before the new nexus refresh-local-auth or the new allod secret reads its checkout; both fail by name until then.

Decision for the rename, recorded here as the issue asks. Names: the file becomes `rotation-registry.json` and the flake export becomes `lib.rotationRegistry`. Human-facing text calls it the credential rotation registry. Compatibility window rather than a flag day for the export: the first secrets PR renames the file, exports `lib.rotationRegistry`, and keeps `lib.forgejoTokenGroups` as a deprecated alias of the same validated value, so a deploy lock cascade that advances secrets before archetypes keeps evaluating. The file name is a flag day for `allod secret declare`, which opens the file by name, so tools lands right after secrets. Landing order: 1. allod/secrets: rename plus alias (Refs). 2. allod/tools, allod/nexus, allod/archetypes in any order, each reading `lib.rotationRegistry` with no fallback to the old name. The archetypes PR bumps its secrets lock to the merged secrets commit before it merges. allod/memory's `age.md` follows as a docs-only PR. 3. allod/deploy: the lock cascade advances secrets before archetypes. 4. allod/secrets: remove the alias (Closes this issue) once every consumer above has landed and deploy's lock has moved. A deployment's private fork of allod/secrets must merge the rename before the new nexus `refresh-local-auth` or the new `allod secret` reads its checkout; both fail by name until then.
allod-agent commented 2026-09-19 18:56:22 +01:00
Member
Copy link

Implementation PRs, in the landing order above:

  1. #31 — rename the file and export, keep lib.forgejoTokenGroups as a deprecated alias (R3, reviewed).
  2. allod/tools#219 — allod secret reads lib.rotationRegistry and writes rotation-registry.json (R3, reviewed). Land after 1.
  3. allod/nexus#60 — refresh-local-auth evaluates lib.rotationRegistry (R3, reviewed). Land after 1.
  4. allod/archetypes#78 — credential-profiles reads secrets.lib.rotationRegistry (R3, reviewed). Needs a flake.lock bump to the merged secrets commit after 1 lands; until then its check fails by attribute name, as the PR body states.
  5. allod/memory#57 — age.md names the new file (R0).

Still to do after those merge: advance the deploy lock with secrets before archetypes, then a final secrets PR that removes the alias and closes this issue. The deployment's private fork of allod/secrets must merge the rename from PR 31 before the new nexus or tools reads its checkout.

Implementation PRs, in the landing order above: 1. https://forge.anarch.diy/allod/secrets/pulls/31 — rename the file and export, keep `lib.forgejoTokenGroups` as a deprecated alias (R3, reviewed). 2. https://forge.anarch.diy/allod/tools/pulls/219 — `allod secret` reads `lib.rotationRegistry` and writes `rotation-registry.json` (R3, reviewed). Land after 1. 3. https://forge.anarch.diy/allod/nexus/pulls/60 — `refresh-local-auth` evaluates `lib.rotationRegistry` (R3, reviewed). Land after 1. 4. https://forge.anarch.diy/allod/archetypes/pulls/78 — `credential-profiles` reads `secrets.lib.rotationRegistry` (R3, reviewed). Needs a `flake.lock` bump to the merged secrets commit after 1 lands; until then its check fails by attribute name, as the PR body states. 5. https://forge.anarch.diy/allod/memory/pulls/57 — `age.md` names the new file (R0). Still to do after those merge: advance the deploy lock with secrets before archetypes, then a final secrets PR that removes the alias and closes this issue. The deployment's private fork of allod/secrets must merge the rename from PR 31 before the new nexus or tools reads its checkout.
vnprc closed this issue 2026-09-19 23:00:29 +01:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
No results found.
Labels
Clear labels   
blocked
Groom: conflicts with master, based on another open PR, or has unanswered review findings

  
bug
Something is not working

  
decision
Groom: open past 30 days with a yes/no the owner has to answer

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
handoff
Public instruction channel for work that lands in a deployment's private forks

  
help wanted
Need some help

  
invalid
Something is wrong

  
landed?
Groom: a merged PR or master commit references this, no Closes line; confirm by hand

  
question
More information is needed

  
ready-to-merge
Groom: base is master, merges clean, no unanswered review findings

  
stale
Groom: no comment or commit in 30 days

  
wontfix
This won't be fixed

  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
blocked
bug
decision
duplicate
enhancement
handoff
help wanted
invalid
landed?
question
ready-to-merge
stale
wontfix
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
allod/secrets#22
No description provided.