Skip to content

Releases: sophie4869/keyrotate

Release list

v0.1.1 — Cloud Run resilience + push-scoping

v0.1.1 — Cloud Run resilience + push-scoping Latest
Latest

Choose a tag to compare

View all tags
@sophie4869 sophie4869 released this 06 Jul 05:37
v0.1.1
c9a5a1c

Patch release focused on making partial-failure recovery painless. See CHANGELOG.md for full detail.

Highlights

🐛 Fixed: one broken Cloud Run service no longer holds the fleet hostage

Previously, a single un-bootable container (unrelated latent bug on one service) killed the whole secret rotate / set run under set -e, silently starving every later target and every downstream crossProjectPropagate project of the new value. prop_cloud_run's gcloud run services update --update-secrets now logs a ⚠️ and continues.

✨ Added: --only-project <name> for surgical recovery

Restrict a push to one project (owning or crossProjectPropagate, alias-resolved). Composes with --targets:

# Re-push JWT_SECRET to just VocabCompanion's Koyeb sink,
# without touching any other project or any other target:
secret set s0 JWT_SECRET=$V --targets koyeb --only-project VocabCompanion

🔧 Changed: --targets now filters WITHIN crossProjectPropagate

Previously --targets also skipped cross-project propagation entirely, which meant --targets koyeb couldn't reach a downstream-only Koyeb sink. Now the same target filter applies to cross-project targets too — including retries like --targets ssh that need to fan out across the fleet after a partial failure.

Upgrade

brew upgrade keyrotate                            # if you installed via the Homebrew tap
git -C ~/keyrotate pull && bash ~/keyrotate/install.sh   # if you installed from source
Assets 2
Loading

v0.1.0 — first tagged release

v0.1.0 — first tagged release

Choose a tag to compare

View all tags
@sophie4869 sophie4869 released this 06 Jul 04:40
v0.1.0
82fbaf4

First tagged release. keyrotate is production-ready for the maintainer's own use across ~14 projects; API is not frozen yet — expect additive changes in 0.x.

Full details in CHANGELOG.md.

Highlights

  • 8 propagation targets: Vercel, Cloud Run, GCP Secret Manager, Koyeb, GitHub Actions, MongoDB Atlas (password rotation via Admin API), SSH (raw + .env-line update), local .env.
  • Cross-project propagation — one secret owned by one config lands in many downstream projects' targets. Ideal for JWT signing secrets shared across an auth service and its verifiers.
  • Multi-key rotate/set with KEY=value shorthand — batched Vercel redeploys deduplicated by projectId (rotate N keys hitting one project = one redeploy, not N).
  • Auto-redeploy after value updates on Vercel and Koyeb (both platforms don't hot-reload env vars).
  • LLM-agent-safe by design — configs are values-free (project IDs, cluster hosts, target lists — no passwords ever). Includes a managing-secrets Claude Code skill template that teaches agents to read the inventory (secret list / notes / ls) without ever touching .env.
  • Failure-mode transparency — secret rotate is sequential + no-rollback by design; README documents the exact recovery recipe when a sink fails mid-run (secret set --targets <failed-target> with the value re-read from a succeeded sink).

Install

git clone https://github.com/sophie4869/keyrotate ~/Projects/keyrotate
~/Projects/keyrotate/install.sh

Homebrew tap coming (see packaging/homebrew/keyrotate.rb).

Requires

macOS (Keychain for provider creds), jq, and — per target — one or more of: gcloud, gh, curl, openssl, ssh.

Loading