vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-forge: timestamp-suffix the swarm-controller token name to avoid a re-mint collision

Browse source
This commit is contained in:
damocles 2026-08-24 16:02:42 +02:00
commit 7e253a3421
1 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/host-modules/hive-forge/default.nix
View file

@ -1104,9 +1104,20 @@ in
# (see its own comment) — so an existing deployment needs # (see its own comment) — so an existing deployment needs
# its token file deleted to force a re-mint with the new # its token file deleted to force a re-mint with the new
# scope. # scope.
#
# Token name carries a timestamp suffix rather than the
# fixed `swarm-controller-boot` this used to be — a real
# incident, not a hypothetical: deleting the token *file*
# (the remediation above) doesn't delete the token Forgejo
# already has under that name, so re-running this unit hit
# "Command error: access token name has been used already"
# and failed outright. Same fix `hive-c0re::forge::users::
# mint_token` already uses for its own agent tokens, for
# the identical reason — a monotonic suffix means a re-mint
# can never collide with whatever this account already has.
out=$(forgejo admin user generate-access-token \ out=$(forgejo admin user generate-access-token \
--username ${lib.escapeShellArg swarmControllerForgeUser} \ --username ${lib.escapeShellArg swarmControllerForgeUser} \
--token-name swarm-controller-boot \ --token-name "swarm-controller-boot-$(date +%s)" \
--scopes "write:repository,write:organization,write:issue,read:user,write:admin") --scopes "write:repository,write:organization,write:issue,read:user,write:admin")
token=$(printf '%s' "$out" | grep -oE '[0-9a-f]{32,}' | head -n1) token=$(printf '%s' "$out" | grep -oE '[0-9a-f]{32,}' | head -n1)
if [ -z "$token" ]; then if [ -z "$token" ]; then