CIAgent
2443909362
---ci--- project: nova-platform milestone: v1.0 status: complete requirements: covered: [REQ-01,REQ-02,REQ-03,REQ-04,REQ-05,REQ-06,REQ-07,REQ-08,REQ-09,REQ-10,REQ-11,REQ-12,REQ-13,REQ-14,REQ-15,REQ-16,REQ-17,REQ-18,REQ-19,REQ-20,REQ-21,REQ-22,REQ-23,REQ-24,REQ-25,REQ-26,REQ-27,REQ-28,REQ-29,REQ-30,REQ-31,REQ-32,REQ-33,REQ-34,REQ-35,REQ-36,REQ-37,REQ-38] partial: [] ---/ci--- v1.0 milestone complete: simplified infrastructure-delivery platform derived from Nova (acdl). 6 phases (P0-P5 + P6 final). 38 REQ-IDs. 38 decisions (D-001..D-038). 76 tests pass. Engine boundary holds. Happy paths green (check-only + CI). 13 L1 + 2 L2 modules. 5 terraform roots. Shell reproducibility. Zero OOS files. Tags: v0.1.0 (P0) → v0.1.1..v0.1.5 (P1..P5) → v0.1.6 (P6 = milestone release on v0.1 patch line).
34 lines
1.3 KiB
Bash
Executable File
34 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Nova Platform — Rotate the spike runner key into .env.secrets.
|
|
#
|
|
# Requires NOVA_BOOTSTRAP_AWS_* (or NOVA_AWS_* fallback) for the bootstrap
|
|
# IAM actions. Writes NOVA_AWS_ACCESS_KEY_ID + NOVA_AWS_SECRET_ACCESS_KEY
|
|
# to .ciagent/.env.secrets (chmod 600, gitignored). Never echoes the secret.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
SECRETS="$ROOT/.ciagent/.env.secrets"
|
|
|
|
if [ -z "${NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID:-${NOVA_AWS_ACCESS_KEY_ID:-${AWS_ACCESS_KEY_ID:-}}}" ]; then
|
|
echo "FAIL: set NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID + NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY" >&2
|
|
exit 1
|
|
fi
|
|
|
|
OUT=$(python3 "$ROOT/terraform/bootstrap/create_iam_user.py")
|
|
KEY=$(echo "$OUT" | grep '^NOVA_AWS_ACCESS_KEY_ID=' | cut -d= -f2)
|
|
SECRET=$(echo "$OUT" | grep '^NOVA_AWS_SECRET_ACCESS_KEY=' | cut -d= -f2)
|
|
|
|
if [ -z "$KEY" ] || [ -z "$SECRET" ]; then
|
|
echo "FAIL: no new key returned (existing key may be active)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
touch "$SECRETS"
|
|
chmod 600 "$SECRETS"
|
|
grep -v '^NOVA_AWS_ACCESS_KEY_ID=' "$SECRETS" 2>/dev/null | grep -v '^NOVA_AWS_SECRET_ACCESS_KEY=' > "$SECRETS.tmp" || true
|
|
echo "NOVA_AWS_ACCESS_KEY_ID=$KEY" >> "$SECRETS.tmp"
|
|
echo "NOVA_AWS_SECRET_ACCESS_KEY=$SECRET" >> "$SECRETS.tmp"
|
|
mv "$SECRETS.tmp" "$SECRETS"
|
|
chmod 600 "$SECRETS"
|
|
echo "=== KEY ROTATED ==="
|
|
echo " written to: $SECRETS (mode 600)" |