docs: note the release-secrets 1Password bundle for maintainers#7
Merged
Merged
Conversation
…RT-77] Point maintainers at cc-data-release-secrets.zip in the Developer Admin 1Password vault, which can re-create the GitHub Actions secrets the signed release needs (restore, rotate, or onboard a new maintainer). Kept high-level: no contents, since this is a public repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a short maintainer note to the README's Development section pointing at the release-credentials backup.
The macOS signing/notarization and Homebrew-tap credentials the release needs live in this repo's GitHub Actions secrets. The note tells maintainers those secrets can be re-created from
cc-data-release-secrets.zipin the Developer Admin 1Password vault, and why the bundle exists: restoring, rotating, or handing the release process to a new maintainer without redoing the Apple and GitHub setup from scratch (the tap push token is a fine-grained GitHub PAT capped at a 365-day lifetime, so it needs yearly rotation).Deliberately high-level: no listing of the bundle's contents or secret values, since this is a public repo.