Remove the deprecated lib.forgejoTokenGroups alias #32

Merged

vnprc merged 1 commit from agent/remove-registry-alias into master

2026-09-19 23:00:29 +01:00

allod-agent commented

2026-09-19 22:57:32 +01:00

Member

The deprecated export lib.forgejoTokenGroups is removed; the credential rotation registry is now reachable only as lib.rotationRegistry. What changes for a running machine: nothing, because every consumer already reads the new name (allod/archetypes PR 78, allod/nexus PR 60, allod/tools PR 219, all merged) and the deploy lock pins a secrets commit that exports it, with tools and nexus pins that include those consumers. What stays identical: the registry file, its validation, and the value of lib.rotationRegistry, which hashes exactly as it did on the reviewed rename commit. What proves it: the three registry checks pass, and evaluating the old name now fails by attribute. If it is wrong the symptom is an evaluation error naming forgejoTokenGroups from something not yet moved, and the fix is a revert of this one commit, which restores the alias.

Before merging: the deployment's private fork of allod/secrets must carry the rename already, and any VM still running an allod binary older than allod/tools PR 219 loses allod secret against a checkout without the alias until it is rebuilt.

Closes allod/secrets#22

Risk

R2. Removes a name nothing on master reads; the failure mode is a loud evaluation error and rollback is one revert.

Validation

Run by the integrator on the reviewed commit:

nix build .#checks.x86_64-linux.credential-registry .#checks.x86_64-linux.credential-inventory .#checks.x86_64-linux.local-auth-refresh --no-link: exit 0.
nix eval --json .#lib.rotationRegistry | sha256sum: 29836d4c…, unchanged from the rename PR.
nix eval .#lib.forgejoTokenGroups: fails, "does not provide attribute … lib.forgejoTokenGroups".
grep -rn -i 'forgejo-token-groups\|forgejoTokenGroups' . outside .git: no hits.

Cold review: gpt-5.6-terra via codex exec, default effort, read-only sandbox, on commit abdf3d13. No findings, no missed consumers, no unsupported claims; the reviewer searched the snapshot for both old names and found none.

The deprecated export `lib.forgejoTokenGroups` is removed; the credential rotation registry is now reachable only as `lib.rotationRegistry`. What changes for a running machine: nothing, because every consumer already reads the new name (allod/archetypes PR 78, allod/nexus PR 60, allod/tools PR 219, all merged) and the deploy lock pins a secrets commit that exports it, with tools and nexus pins that include those consumers. What stays identical: the registry file, its validation, and the value of `lib.rotationRegistry`, which hashes exactly as it did on the reviewed rename commit. What proves it: the three registry checks pass, and evaluating the old name now fails by attribute. If it is wrong the symptom is an evaluation error naming `forgejoTokenGroups` from something not yet moved, and the fix is a revert of this one commit, which restores the alias. Before merging: the deployment's private fork of allod/secrets must carry the rename already, and any VM still running an `allod` binary older than allod/tools PR 219 loses `allod secret` against a checkout without the alias until it is rebuilt. Closes allod/secrets#22 ## Risk R2. Removes a name nothing on master reads; the failure mode is a loud evaluation error and rollback is one revert. ## Validation Run by the integrator on the reviewed commit: - `nix build .#checks.x86_64-linux.credential-registry .#checks.x86_64-linux.credential-inventory .#checks.x86_64-linux.local-auth-refresh --no-link`: exit 0. - `nix eval --json .#lib.rotationRegistry | sha256sum`: 29836d4c…, unchanged from the rename PR. - `nix eval .#lib.forgejoTokenGroups`: fails, "does not provide attribute … lib.forgejoTokenGroups". - `grep -rn -i 'forgejo-token-groups\|forgejoTokenGroups' .` outside `.git`: no hits. Cold review: `gpt-5.6-terra` via `codex exec`, default effort, read-only sandbox, on commit abdf3d13. No findings, no missed consumers, no unsupported claims; the reviewer searched the snapshot for both old names and found none.

allod-agent added 1 commit

2026-09-19 22:57:33 +01:00