continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

feat(P03 W7): secret rotation scheduled workflow (SPEC §5.9)

Browse Source 
workflows-src/rotate-aws-key.yml — daily cron (0 0 * * *) + workflow_dispatch,
wraps scripts/rotate_spike_key.sh (uses NOVA_AWS_* static-key auth to IAM-
rotate the nova-spike-runner key; uploads the new key to the consumer's
Actions secret store; idempotent — deactivates the old key only after the
new propagates, verified by a post-PUT GET). Synced to .github + .gitea.
v0.2 scope: the mechanism exists (SPEC §5.9 — exists-not-ran); the v0.2
deploy uses the currently-active key. Documented in ARCHITECTURE.md §12.9.

The synced workflow file is forge-agnostic (REQ-230): forge base URL /
owner / consumer repo come from repository secrets (NOVA_FORGE_*,
NOVA_CONSUMER_REPO), not literals. rotate_spike_key.sh reads NOVA_FORGE_*
with NOVA_GITEA_* backward-compat fallback. sync_workflows.py PAIRS
extended to include rotate-aws-key.yml (was hardcoded to 3 pairs).

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W7
---
This commit is contained in:
Jon Chery
2026-08-18 23:39:34 +00:00
parent b237b3e85b
commit 9bac2685cb
7 changed files with 445 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/ARCHITECTURE.md
+14 -1
View File
@@ -503,4 +503,17 @@ binary is not installed).
> **§12.8 — Pilot Estate** is planned for the v1.26 P4 phase (REQ-321).
> It will document the live-pilot architecture (consumer contract →
> `deploy.yml@v1.25` → apply → attest → record against `581513795199`).
> `deploy.yml@v1.25` → apply → attest → record against `581513795199`).
### §12.9 — Secret Rotation (v1.26 P3 W7, SPEC §5.9 — current)
The platform-managed scheduled workflow `workflows-src/rotate-aws-key.yml`
rotates the `NOVA_AWS_*` static key daily (cron `0 0 * * *`) and on
`workflow_dispatch`. v0.2 scope: the mechanism exists (SPEC §5.9 —
exists-not-ran); the v0.2 deploy uses the currently-active key. The
rotation is idempotent — `scripts/rotate_spike_key.sh` deactivates the old
key only after the new one propagates to the consumer's Actions secret
store, verified by a post-PUT GET; on upload/verify failure the old key is
left Active and the run exits non-zero. The synced workflow file is
forge-agnostic (REQ-230): forge base URL / owner / consumer repo come from
repository secrets (`NOVA_FORGE_*`, `NOVA_CONSUMER_REPO`), not literals.