Github::Client wraps the bearer-auth REST API with required 'X-GitHub-Api-Version: 2022-11-28' header. Implements me, create_pat (POST /user/personal-access-tokens), delete_pat (DELETE by id). GithubPatRotator's 4-step contract: - generate: create_pat returns new id + token value (fresh PAT alongside old) - apply: no-op (create_pat already active) - verify: probe-client uses the NEW PAT to GET /user; success means it works - commit: delete OLD PAT by id (tracked via old_pat_id tag) - rollback_apply: delete NEW PAT 7 unit specs verify create/delete/me round-trips, full rotation path, verify-on-401, and rollback deletion. |
||
|---|---|---|
| .. | ||
| .github/workflows | ||
| spec | ||
| src | ||
| .editorconfig | ||
| .gitignore | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| shard.lock | ||
| shard.yml | ||
README.md
Credential Rotation Enforcer (cre)
A Crystal-based daemon that tracks and enforces credential rotation
policies across AWS Secrets Manager, HashiCorp Vault, GitHub fine-grained
PATs, and local .env files.
Full README, asciinema demos, and walkthrough live in
learn/. This README will be expanded in Phase 16 of the build.