keymap-cli 0.0.0-stage → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +113 -2
- package/dist/cli.js +12062 -0
- package/package.json +55 -4
- package/templates/keymap-audit.yml +68 -0
package/package.json
CHANGED
|
@@ -1,6 +1,57 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "keymap-cli",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"
|
|
5
|
-
"
|
|
6
|
-
|
|
3
|
+
"version": "0.1.0",
|
|
4
|
+
"description": "Values-free map of every secret you run, where it lives, and one command to rotate it everywhere.",
|
|
5
|
+
"license": "MIT",
|
|
6
|
+
"author": "Nekruz Kasimov",
|
|
7
|
+
"repository": {
|
|
8
|
+
"type": "git",
|
|
9
|
+
"url": "git+https://github.com/NekruzKasimov/keymap-cli.git"
|
|
10
|
+
},
|
|
11
|
+
"homepage": "https://github.com/NekruzKasimov/keymap-cli#readme",
|
|
12
|
+
"bugs": {
|
|
13
|
+
"url": "https://github.com/NekruzKasimov/keymap-cli/issues"
|
|
14
|
+
},
|
|
15
|
+
"keywords": [
|
|
16
|
+
"secrets",
|
|
17
|
+
"rotation",
|
|
18
|
+
"rotate",
|
|
19
|
+
"env",
|
|
20
|
+
"dotenv",
|
|
21
|
+
"railway",
|
|
22
|
+
"vercel",
|
|
23
|
+
"fly",
|
|
24
|
+
"cloudflare",
|
|
25
|
+
"supabase",
|
|
26
|
+
"github-actions",
|
|
27
|
+
"security",
|
|
28
|
+
"incident"
|
|
29
|
+
],
|
|
30
|
+
"type": "module",
|
|
31
|
+
"bin": {
|
|
32
|
+
"keymap": "dist/cli.js"
|
|
33
|
+
},
|
|
34
|
+
"files": [
|
|
35
|
+
"dist",
|
|
36
|
+
"templates",
|
|
37
|
+
"README.md"
|
|
38
|
+
],
|
|
39
|
+
"scripts": {
|
|
40
|
+
"build": "tsup",
|
|
41
|
+
"dev": "tsx src/cli.ts",
|
|
42
|
+
"test": "vitest run",
|
|
43
|
+
"typecheck": "tsc --noEmit"
|
|
44
|
+
},
|
|
45
|
+
"engines": {
|
|
46
|
+
"node": ">=20"
|
|
47
|
+
},
|
|
48
|
+
"devDependencies": {
|
|
49
|
+
"@types/node": "^22.13.0",
|
|
50
|
+
"tsup": "^8.4.0",
|
|
51
|
+
"tsx": "^4.19.0",
|
|
52
|
+
"typescript": "^5.8.0",
|
|
53
|
+
"vitest": "^3.1.0",
|
|
54
|
+
"commander": "^13.1.0",
|
|
55
|
+
"yaml": "^2.7.0"
|
|
56
|
+
}
|
|
57
|
+
}
|
|
@@ -0,0 +1,68 @@
|
|
|
1
|
+
# Daily secret audit with keymap. Copy to .github/workflows/keymap-audit.yml
|
|
2
|
+
#
|
|
3
|
+
# Everything here is pinned: actions by commit SHA (verified against upstream tags), npm packages by exact
|
|
4
|
+
# version, flyctl by release. keymap-cli bundles its dependencies; the host CLIs resolve their own
|
|
5
|
+
# transitive dependencies from npm, which is the residual supply-chain exposure of this job.
|
|
6
|
+
# Bump the versions on purpose, not by accident. This job holds host tokens, so it must never
|
|
7
|
+
# install anything unpinned.
|
|
8
|
+
#
|
|
9
|
+
# Repository secrets, only for the hosts your keymap.yaml references:
|
|
10
|
+
# KEYMAP_GH_TOKEN fine-grained PAT, this repo only, permission "Secrets: read" (GITHUB_TOKEN cannot list secrets)
|
|
11
|
+
# RAILWAY_TOKEN Railway -> Account -> Tokens (project token scoped to the one project)
|
|
12
|
+
# VERCEL_TOKEN Vercel -> Account -> Tokens; the Vercel CLI reads this variable
|
|
13
|
+
# FLY_API_TOKEN `flyctl tokens create readonly`
|
|
14
|
+
# CLOUDFLARE_API_TOKEN Workers Scripts: read
|
|
15
|
+
# SUPABASE_ACCESS_TOKEN Supabase -> Account -> Access tokens
|
|
16
|
+
# KEYMAP_WEBHOOK optional Slack or Discord incoming webhook for the daily summary
|
|
17
|
+
name: keymap audit
|
|
18
|
+
on:
|
|
19
|
+
schedule:
|
|
20
|
+
- cron: "17 6 * * *"
|
|
21
|
+
workflow_dispatch:
|
|
22
|
+
permissions:
|
|
23
|
+
contents: read
|
|
24
|
+
jobs:
|
|
25
|
+
audit:
|
|
26
|
+
runs-on: ubuntu-latest
|
|
27
|
+
env:
|
|
28
|
+
KEYMAP_VERSION: "0.1.0"
|
|
29
|
+
steps:
|
|
30
|
+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
31
|
+
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
|
32
|
+
with:
|
|
33
|
+
node-version: 22
|
|
34
|
+
- name: Install keymap and the host CLIs this manifest uses (exact versions, no install scripts)
|
|
35
|
+
run: |
|
|
36
|
+
set -euo pipefail
|
|
37
|
+
# keymap-cli bundles its two dependencies, so this installs exactly one package.
|
|
38
|
+
npm i -g --ignore-scripts "keymap-cli@${KEYMAP_VERSION}"
|
|
39
|
+
uses() { grep -Eq "^\s*-?\s*(${1}|kind: ${1})\b" keymap.yaml; }
|
|
40
|
+
# @railway/cli downloads its binary in a postinstall step, so scripts stay enabled for that one package.
|
|
41
|
+
uses railway && npm i -g @railway/cli@5.71.0 || true
|
|
42
|
+
uses vercel && npm i -g --ignore-scripts vercel@65.1.0 || true
|
|
43
|
+
uses cloudflare && npm i -g --ignore-scripts wrangler@4.151.3 || true
|
|
44
|
+
uses supabase && npm i -g --ignore-scripts supabase@2.121.0 || true
|
|
45
|
+
- name: Install flyctl (pinned release)
|
|
46
|
+
uses: superfly/flyctl-actions/setup-flyctl@dfdfedc86b296f5e5384f755a18bf400409a15d0 # v1.4
|
|
47
|
+
with:
|
|
48
|
+
version: 0.4.120
|
|
49
|
+
- name: Audit
|
|
50
|
+
env:
|
|
51
|
+
GH_TOKEN: ${{ secrets.KEYMAP_GH_TOKEN }}
|
|
52
|
+
RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
|
|
53
|
+
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
|
|
54
|
+
FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
|
|
55
|
+
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
|
56
|
+
SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
|
|
57
|
+
run: keymap audit
|
|
58
|
+
- name: Remind
|
|
59
|
+
if: always()
|
|
60
|
+
env:
|
|
61
|
+
GH_TOKEN: ${{ secrets.KEYMAP_GH_TOKEN }}
|
|
62
|
+
RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
|
|
63
|
+
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
|
|
64
|
+
FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
|
|
65
|
+
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
|
66
|
+
SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
|
|
67
|
+
KEYMAP_WEBHOOK: ${{ secrets.KEYMAP_WEBHOOK }}
|
|
68
|
+
run: if [ -n "${KEYMAP_WEBHOOK:-}" ]; then keymap remind; fi
|