Publish with a key instead of a password - #15
Merged
Merged
Conversation
`termcade keys` manages publish credentials, and `termcade publish` takes one from TERMCADE_TOKEN. That is what lets a release workflow publish on a machine nobody is logged in to. The environment wins over a stored session, deliberately: a runner with somebody's leftover login should not silently publish as them. The token prints once, because it exists once — the registry keeps a hash and cannot produce it again — and the reminder goes to stderr so piping the command to a secret store still captures the token alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Client half of publish keys. Pairs with aviorstudio/termcade-be#11.
$ termcade keys new release-workflow aviorstudio created "release-workflow", publishing as aviorstudio tck__7WVTx94h5mopsk7F6kpcUifGrZTOGPay4LCof3L4KA that token is shown once and cannot be recovered — put it somewhere safe nowThen, on a machine nobody is logged in to:
Three details
The environment wins over a stored session. A runner carrying somebody's leftover login should not silently publish as them.
The token prints once, because it exists once — the registry keeps a hash and cannot produce it again.
The reminder goes to stderr, so piping the command into a secret store captures the token alone.
termcade keys listshows name, handle and last use;termcade keys revoke <id>kills one.Verification
go vetclean, full suite passes. On a scratch stack: created a key, deleted the session file entirely, and publishedaviorstudio/tetrisfrom its real GitHub release with onlyTERMCADE_TOKENset. A key scoped to a different handle was refused and created nothing.🤖 Generated with Claude Code