45 lines
2.0 KiB
Markdown
45 lines
2.0 KiB
Markdown
# PR#86: The Secrets of the Coding Agents Have One Place
|
|
|
|
> **WARNING:** This document describes only the change applied in this PR.
|
|
> It may already be outdated once the next PR is merged.
|
|
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.
|
|
|
|
## Problem
|
|
|
|
The secrets of the coding agents moved on 2026-10-07 from `~/.config/pr-agent-test/secrets.env`
|
|
to `~/.config/ai-coding-agents/secrets.env`; the old path is a symlink since then.
|
|
`docs/agentic-workflow.md` names the new path, but `docs/betrieb-git.javagil.de.md` still names the old one,
|
|
also for the backups of the branch protection rules.
|
|
|
|
On 2026-10-11 the token of `ai-reviewer` reached the transcript of a coding session.
|
|
The operations guide does not say how to replace that token.
|
|
|
|
## Non-Goals
|
|
|
|
- No change of werkrevisor's code or configuration.
|
|
|
|
## Solution
|
|
|
|
- `docs/betrieb-git.javagil.de.md` names `~/.config/ai-coding-agents/secrets.env`
|
|
and `~/.config/ai-coding-agents/backups/` for the backups of the branch protection rules.
|
|
- The table of secrets names the machine configs of all reviewed repositories as place of `GITEA_BOT_TOKEN`,
|
|
instead of the one of werkprobe.
|
|
- A new section says how to replace the token of `ai-reviewer`.
|
|
- Werkbaum: `#ops.secrets` and `#ops.rotate`; `#ops.basecommit` is deployed.
|
|
- Version 0.32.12.
|
|
|
|
## Open Questions
|
|
|
|
None.
|
|
|
|
## Additional Changes
|
|
|
|
Done outside the repository, so not part of the diff:
|
|
|
|
- On the workstation, `taiga.refresh` and the backups moved to the new directory, `~/bin/taiga` reads the new path,
|
|
and the symlink and the directory `~/.config/pr-agent-test/` are gone.
|
|
No `origin/main` of the repositories under `~/Projekte` names the old path any more.
|
|
- The token of `ai-reviewer` was replaced as the new section says:
|
|
in `secrets.env` and the five machine configs on mih09; the old token is revoked and answers HTTP 401.
|
|
The 120 older backups of the machine configs on mih09 hold the new token too, so a rollback still works.
|