Rockachopa/Timmy-time-dashboard
1
0
Fork 2
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

[Security] Develop an Automatic Token Rotation Script for Gitea Agent Credentials #1421

New Issue
Closed
opened 2026-03-24 13:04:37 +00:00 by Timmy · 1 comment
Timmy commented 2026-03-24 13:04:37 +00:00
Owner
Copy Link

Context: Gitea API tokens possess no automated expiry loop.

Acceptance Criteria:

  • Integrate a 30-day token rotation protocol using Gitea integration commands.
  • Revoke previous token post-rotation.
**Context:** Gitea API tokens possess no automated expiry loop. **Acceptance Criteria:** - Integrate a 30-day token rotation protocol using Gitea integration commands. - Revoke previous token post-rotation.
Timmy commented 2026-03-24 14:45:21 +00:00
Author
Owner
Copy Link

Implementation Plan for Token Rotation Script

Priority: HIGH - Security vulnerability (plaintext tokens with no rotation)

Files to Create/Modify:

  1. scripts/rotate-gitea-tokens.sh - Main rotation script
  2. scripts/ops-helpers.sh - Add token rotation helper function
  3. .github/workflows/token-rotation.yml or cron job setup

Implementation Steps:

  1. Create Token Rotation Script (scripts/rotate-gitea-tokens.sh):

    • Generate new Gitea API token via API call
    • Update ~/.hermes/gitea_token atomically (write to temp file, then rename)
    • Revoke old token via API
    • Log rotation events with timestamps
    • Include error handling and rollback on failure

  2. Add Ops Helper Function (scripts/ops-helpers.sh):

    • Add rotate_gitea_token() function
    • Include validation for token format and permissions
    • Add verify_token_permissions() helper

  3. Automation Setup:

    • Create cron job or GitHub Action for weekly rotation
    • Include notification on rotation failure
    • Test in staging environment first

Key Security Requirements:

  • Atomic file operations (no partial writes)
  • Proper file permissions (600 for token files)
  • Secure cleanup of old tokens
  • Comprehensive error logging
  • Rollback capability on failure

Testing:

  • Verify new token works before revoking old one
  • Test with invalid credentials
  • Test file permission scenarios
  • Verify cron job integration

Acceptance Criteria Met When:

  • Script successfully rotates tokens without service interruption
  • Old tokens are properly revoked
  • Process is fully automated (weekly cron job)
  • Comprehensive error handling and logging
  • Documentation updated

This addresses a critical security gap - plaintext tokens with no expiry/rotation cycle.

## Implementation Plan for Token Rotation Script **Priority**: HIGH - Security vulnerability (plaintext tokens with no rotation) **Files to Create/Modify**: 1. `scripts/rotate-gitea-tokens.sh` - Main rotation script 2. `scripts/ops-helpers.sh` - Add token rotation helper function 3. `.github/workflows/token-rotation.yml` or cron job setup **Implementation Steps**: 1. **Create Token Rotation Script** (`scripts/rotate-gitea-tokens.sh`): - Generate new Gitea API token via API call - Update `~/.hermes/gitea_token` atomically (write to temp file, then rename) - Revoke old token via API - Log rotation events with timestamps - Include error handling and rollback on failure 2. **Add Ops Helper Function** (`scripts/ops-helpers.sh`): - Add `rotate_gitea_token()` function - Include validation for token format and permissions - Add `verify_token_permissions()` helper 3. **Automation Setup**: - Create cron job or GitHub Action for weekly rotation - Include notification on rotation failure - Test in staging environment first **Key Security Requirements**: - Atomic file operations (no partial writes) - Proper file permissions (600 for token files) - Secure cleanup of old tokens - Comprehensive error logging - Rollback capability on failure **Testing**: - Verify new token works before revoking old one - Test with invalid credentials - Test file permission scenarios - Verify cron job integration **Acceptance Criteria Met When**: - Script successfully rotates tokens without service interruption - Old tokens are properly revoked - Process is fully automated (weekly cron job) - Comprehensive error handling and logging - Documentation updated This addresses a critical security gap - plaintext tokens with no expiry/rotation cycle.
kimi was assigned by Timmy 2026-03-24 14:45:21 +00:00
kimi was unassigned by Timmy 2026-03-24 19:32:17 +00:00
Timmy closed this issue 2026-03-24 21:54:07 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
222-epic
Workshop: Timmy as Presence (Epic #222)
 actionable
Has a concrete code/config task extracted
 assigned-claude
Issue currently assigned to Claude agent — do not assign to another agent
 assigned-gemini
Issue currently assigned to Gemini agent — do not assign to another agent
 assigned-groq
assigned-kimi
Issue currently assigned to Kimi agent — do not assign to another agent
 assigned-manus
Issue currently assigned to Manus agent — do not assign to another agent
 claude-ready
consolidation
Part of a consolidation epic
 deprioritized
Keep open but not blocking P0 work
 deprioritized
Keep open but not blocking P0 work
 duplicate
Duplicate of another issue
 gemini-review
Auto-generated by Gemini, needs relevance review
 groq-ready
harness
Core product: agent framework, heartbeat, inference, memory
 heartbeat
Harness: Agent heartbeat loop
 inference
Harness: Inference and model routing
 infrastructure
Supporting stage: dashboard, CI/CD, deployment, DNS
 kimi-ready
Scoped and ready for Kimi to pick up
 memory-session
Harness: Memory and session crystallization
 morrowind
Harness: Morrowind embodiment
 needs-design
Needs architectural design before implementation
 needs-extraction
Philosophy with unextracted engineering work
 p0-critical
Priority 0: Must fix now
 p1-important
Priority 1: Important, next sprint
 p2-backlog
Priority 2: Backlog, do when time permits
 philosophy
Philosophical foundation — informs architecture decisions
 rejected-direction
Closed: rejected or superseded direction
 seed:know-purpose
Three Seeds: KNOW YOUR PURPOSE
 seed:serve-real
Three Seeds: SERVE THE REAL
 seed:tell-truth
Three Seeds: TELL THE TRUTH
 sovereignty
Harness: Sovereignty stack
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Timmy claude grok kimi manus perplexity Rockachopa
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Rockachopa/Timmy-time-dashboard#1421
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?