Jon Chery 5222a460e5 chore(config): rotate Gitea token to env-var reference (security) ...

---ci---
phase: 0
milestone: v1.0
status: specify
security:
  - id: SEC-001
    type: info_disclosure
    disposition: mitigated
    summary: Literal API token was committed in config.json gitea.api_token_env field
    fix: Replaced literal with env var name 'ACDL_GITEA_TOKEN'; token supplied via shell env at runtime
    severity: high
    stride: Information Disclosure
---/ci---

The 40-char value previously stored in .ciagent/config.json was a live Gitea
API token. Per the spec constraint 'no secrets in repo', the field now holds
an env var name. The token itself is exported in the shell session at runtime
and is never written to disk. Treat the prior value as already-leaked and
rotate it via the Gitea UI before any external disclosure.

2026-07-21 12:55:29 +00:00

.ciagent

chore(config): rotate Gitea token to env-var reference (security)

2026-07-21 12:55:29 +00:00

S

Description

Nova — The New Dawn of DevSecOps. Autonomous infrastructure delivery: consumers declare intent, the platform ships safely with an immutable audit trail.

agenticaudit-ledgerawscontinuous-deploymentdevsecopsgitea-actionsinfrastructure-as-codekyverno-jsonpolicy-as-codeterraform

69 MiB

Releases 128

v1.31 Leadership Deck Polish II (milestone release) Latest

2026-08-20 14:58:56 +00:00

Languages

Python 87.2%

Shell 8.6%

HCL 4.2%