package-registry-manager 0.23.1 → 0.25.0

package/CHANGELOG.md

@@ -24,9 +24,16 @@ currently shares its release version with the Rust implementation.
   variables and secret, `packages: write`, and package linking (#5).
 - `setup --browser default|automated` chooses where sign-in and approval URLs
   open; `default`, the default, uses the user's default browser (#9).
+- An npm first publish stops before the sign-in when the packed tarball
+  contains repository development directories such as `.github/` or `tests/`,
+  which a package.json without a `files` allowlist lets in.
 
 ### Changed
 
+- `setup` stays signed in by default: the npm session token and the crates.io
+  sign-in in the automated profile are kept, so the next run (npm: within two
+  hours) skips the sign-in. `--sign-out` signs out at the end instead;
+  `--keep-session` is still accepted and is now the default.
 - npm web-auth URLs (`npm login`, `npm publish` 2FA, `npm trust`) open in the
   user's default browser (`open`, `xdg-open`, or the Windows URL handler),
   where they are usually already signed in. The automated browser profile is
@@ -35,7 +42,7 @@ currently shares its release version with the Rust implementation.
   outside any repository (`~/Library/Application Support` on macOS,
   `$XDG_STATE_HOME` or `~/.local/state` on Linux, `%LOCALAPPDATA%` on Windows,
   each followed by `package-registry-manager/browser-profile`) (#8).
-- `browser-commander` is required at `^0.33.2`, its latest release (#28). A
+- `browser-commander` is required at `^0.34.0`, its latest release (#28). A
   launch still names its channel (`chrome` by default), so the upstream switch
   of channel-less launches to Chrome for Testing does not change which browser
   opens.

package/README.md

@@ -70,3 +70,10 @@ local `--offline` commands keep local scope. Both CLIs' GitHub dependency needs
 Node.js 22.12 or newer and npm; JavaScript checks the runtime before loading it.
 
 See the [bootstrap, wrapper and credential guide](../docs/registry-setup.md) for branch/PR setup, dual npm names, registry policies and integration limits.
+
+Migration tries trusted publishing first and retains token fallback and expiry
+metadata by default. `--delete-token-secrets` explicitly opts into cleanup after
+OIDC publication and verification that no workflow still uses the credentials.
+Saved crates.io API sessions run headlessly; sign-in opens a visible window only
+when user action is needed. Organization migration skips and reports scan errors
+while continuing for clean repositories.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.23.1",
+  "version": "0.25.0",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -40,9 +40,9 @@
     "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
-    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/29808e088ac8fd8374361920bbebab07a4d63ac6",
-    "browser-commander": "^0.33.2",
-    "command-stream": "^2.4.0",
+    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/293e9a8ab9d6d91a08e95f4e09c2a0dcad9bc809",
+    "browser-commander": "^0.34.0",
+    "command-stream": "^2.6.0",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"
   },

package/src/automation.mjs

@@ -29,14 +29,20 @@ export function relayExtensionDirectory() {
  * the `domains` import scope only the cookies of `domains`, the registry's
  * sign-in domains, are imported.
  */
-export function launchOptions(browser, profile, verbose = false, domains = []) {
+export function launchOptions(
+  browser,
+  profile,
+  verbose = false,
+  domains = [],
+  headless = false,
+) {
   const options = {
     engine:
       findBrowserSource(browser.channel)?.controlProtocol === "cdp"
         ? "playwright"
         : "selenium",
     channel: browser.channel,
-    headless: false,
+    headless,
     verbose,
   };
   if (browser.executable) {
@@ -82,7 +88,7 @@ export function extensionInstructions(directory) {
  * `evaluate`, `close`, and, for a launched profile, `clearCookies(domains)`.
  */
 export async function connectAutomation(
-  { browser, profile, verbose = false, domains = [] },
+  { browser, profile, verbose = false, domains = [], headless = false },
   dependencies = {},
 ) {
   if (browser.attach?.mode === "extension") {
@@ -90,7 +96,7 @@ export async function connectAutomation(
   }
   if (findBrowserSource(browser.channel)?.controlProtocol === "bidi") {
     return connectWebDriverAutomation(
-      { browser, profile, verbose, domains },
+      { browser, profile, verbose, domains, headless },
       dependencies,
     );
   }
@@ -99,8 +105,9 @@ export async function connectAutomation(
   }
   const connection = await (
     dependencies.launchRealBrowser ?? launchRealBrowser
-  )(launchOptions(browser, profile, verbose, domains));
+  )(launchOptions(browser, profile, verbose, domains, headless));
   return {
+    headless,
     goto: (url) => connection.page.goto(url),
     evaluate: (script) => connection.page.evaluate(script),
     close: () => connection.close(),

package/src/browser.mjs

@@ -42,10 +42,10 @@ export function openerSucceeded(file, code) {
  * Starts an opener through command-stream without a shell and settles once it
  * exits, or after `graceMs` while it keeps running in the background.
  */
-export function detachedRunner(graceMs = OPENER_GRACE_MS) {
+export function detachedRunner(graceMs = OPENER_GRACE_MS, spawnChild = spawn) {
   return (file, args) =>
     new Promise((resolve, reject) => {
-      const child = spawn(file, args, {
+      const child = spawnChild(file, args, {
         detached: process.platform !== "win32",
         stdio: "ignore",
         shell: false,

package/src/cli-main.mjs

@@ -36,7 +36,8 @@ Global options:
   --org <org> | --user <login>      Scan repositories through gh-manager
   --secret-name <template>         Secret name; supports {REGISTRY}, {REPO}, {ORG}
   --rotate-token <secret>          Explicitly replace a legacy crates.io token
-  --migrate                       Convert token jobs in PRs, then verify OIDC and clean up secrets
+  --migrate                       Convert jobs to OIDC with token fallback, then verify releases
+  --delete-token-secrets          Opt in to verified unused token and expiry cleanup
   --token-expiry-days <N>          Read browser token inventory in account scans
   --format <text|json>            Output format (default: text)
   --offline                       Do not look up packages on registries
@@ -68,10 +69,12 @@ Setup options:
   --manual                        crates.io: create, use, and revoke the
                                   first-publish token by hand instead of
                                   through the crates.io API
-  --keep-session                  Stay signed in after setup: npm keeps its
-                                  session token in npm's user configuration
-                                  until npm logout; the shared browser profile
-                                  keeps registry sessions across packages
+  --sign-out                      Sign out at the end of setup: npm logout
+                                  for the npm session this run signed in, and
+                                  removal of the crates.io sign-in it brought
+                                  into the automated profile. Without it the
+                                  next run reuses both sessions; npm ends its
+                                  session token after two hours
   --browser <default|automated>   Open sign-in and approval pages in your
                                   default browser, or in the automated profile;
                                   npm reuses the automated profile
@@ -116,6 +119,7 @@ export async function main(args = process.argv.slice(2)) {
       "secret-name": { type: "string" },
       "rotate-token": { type: "string" },
       migrate: { type: "boolean", default: false },
+      "delete-token-secrets": { type: "boolean", default: false },
       "token-expiry-days": { type: "string" },
       format: { type: "string", default: "text" },
       verbose: { type: "boolean", default: false },
@@ -132,6 +136,7 @@ export async function main(args = process.argv.slice(2)) {
       yes: { type: "boolean", default: false },
       "no-browser": { type: "boolean", default: false },
       "open-with": { type: "string" },
+      "sign-out": { type: "boolean", default: false },
       "keep-session": { type: "boolean", default: false },
       manual: { type: "boolean", default: false },
       browser: { type: "string", default: "default" },
@@ -249,6 +254,9 @@ export async function main(args = process.argv.slice(2)) {
     if (values["open-with"] !== undefined && values["no-browser"]) {
       throw new Error("--open-with and --no-browser are mutually exclusive");
     }
+    if (values["sign-out"] && values["keep-session"]) {
+      throw new Error("--sign-out and --keep-session are mutually exclusive");
+    }
     if (!browserOptions.attach) {
       browserOptions.import ??= { browser: "auto", profile: null };
     }
@@ -267,6 +275,7 @@ export async function main(args = process.argv.slice(2)) {
         secretName: values["secret-name"],
         rotateToken,
         migrate: values.migrate,
+        deleteTokenSecrets: values["delete-token-secrets"],
         tokenExpiryDays,
         package: values.package,
         browser: values.browser,
@@ -276,12 +285,13 @@ export async function main(args = process.argv.slice(2)) {
             defaultBrowserProfile({ channel: browserOptions.channel }),
         ),
         openWith: nonEmpty(values["open-with"], "--open-with"),
-        keepSession: values["keep-session"],
+        keepSession: !values["sign-out"],
         planOptions: {
           workflow: values.workflow,
           publisherEnvironment: values.environment,
           addPublishJob: values["add-publish-job"],
           migrate: values.migrate,
+          deleteTokenSecrets: values["delete-token-secrets"],
           manual: values.manual,
           verifyRelease: values["verify-release"],
         },
@@ -325,6 +335,7 @@ export async function main(args = process.argv.slice(2)) {
   const planOptions = {
     rotateToken,
     migrate: values.migrate,
+    deleteTokenSecrets: values["delete-token-secrets"],
     ref: values.ref,
     verifyRelease: values["verify-release"],
     manual: values.manual,
@@ -364,11 +375,15 @@ export async function main(args = process.argv.slice(2)) {
   if (values["open-with"] !== undefined && values["no-browser"]) {
     throw new Error("--open-with and --no-browser are mutually exclusive");
   }
+  if (values["sign-out"] && values["keep-session"]) {
+    throw new Error("--sign-out and --keep-session are mutually exclusive");
+  }
 
   const plans = buildPlans(inspection, registries, planOptions);
-  const selected = values.all
-    ? plans.filter((plan) => plan.package.publishable)
-    : [selectPlan(plans, values.package)];
+  const selected =
+    values.all || (values.migrate && !values.package)
+      ? plans.filter((plan) => plan.package.publishable)
+      : [selectPlan(plans, values.package)];
   outputPlans(selected, values.format);
   await executePlans(
     selected,
@@ -381,10 +396,11 @@ export async function main(args = process.argv.slice(2)) {
       yes: values.yes,
       noBrowser: values["no-browser"],
       openWith: nonEmpty(values["open-with"], "--open-with"),
-      keepSession: values["keep-session"],
+      keepSession: !values["sign-out"],
       secretName: values["secret-name"],
       rotateToken,
       migrate: values.migrate,
+      deleteTokenSecrets: values["delete-token-secrets"],
       quietBrowser: selected.some((plan) =>
         plan.steps.some((step) =>
           ["manage-registry-token", "rotate-crates-token"].includes(step.id),
@@ -399,7 +415,7 @@ export async function main(args = process.argv.slice(2)) {
       verbose: values.verbose,
       verifyRelease: values["verify-release"],
     },
-    values.all,
+    values.all || values.migrate,
   );
 }
 
@@ -511,7 +527,14 @@ function outputInspection(inspection, format) {
         packageInfo.exists_on_registry ? "published" : "not published yet",
       );
     }
-    if (packageInfo.trusted_publishing) {
+    if (packageInfo.registry_http_status) {
+      details.push(
+        `registry state unknown (HTTP ${packageInfo.registry_http_status})`,
+      );
+    }
+    if (packageInfo.publishing_policy === "oidc-with-token-fallback") {
+      details.push("trusted publishing + token fallback");
+    } else if (packageInfo.trusted_publishing) {
       details.push("trusted publishing");
     }
     process.stdout.write(

package/src/crates-api.mjs

@@ -350,11 +350,15 @@ export async function runCratesApiStep(session, step) {
   }
   const crate = plan.package.name;
   const domains = signInDomains(plan.registry);
-  let page = await session.automatedPage();
+  let page = await session.automatedPage(undefined, false, true);
   switch (step.id) {
     case "crates-sign-in": {
       await page.goto(CRATES_IO_URL);
-      if (!(await readSession(page)).signedIn) {
+      const saved = await readSession(page);
+      if (!saved.signedIn || !saved.emailVerified) {
+        page = await session.visiblePage();
+      }
+      if (!saved.signedIn) {
         // Whether imported or signed in by hand, the sign-in is this run's.
         conditions.add("crates-signed-in");
         if (await offerSignInImport(session, domains)) {
@@ -362,6 +366,9 @@ export async function runCratesApiStep(session, step) {
         }
       }
       await signIn(page, options);
+      console.log(
+        "Using your crates.io session to register trusted publishers; no action needed while API requests run.",
+      );
       return;
     }
     case "first-publish": {
@@ -407,7 +414,7 @@ export async function runCratesApiStep(session, step) {
     case "crates-sign-out":
       if (options.keepSession) {
         console.log(
-          `Keeping the ${domains.join(" / ")} sign-in in the automated profile (--keep-session); the next run reuses it. No token is kept.`,
+          `Keeping the ${domains.join(" / ")} sign-in in the automated profile; the next run reuses it. No token is kept.`,
         );
       } else if (page.clearCookies) {
         await page.clearCookies(domains);

package/src/discovery.mjs

@@ -246,6 +246,9 @@ function withPublisher(item, workflows, publishers) {
     return item;
   }
   const result = { ...item };
+  if (publisher.policy) {
+    result.publishing_policy = publisher.policy;
+  }
   if (publisher.workflow) {
     result.workflow = publisher.workflow;
   }
@@ -266,7 +269,9 @@ function withPublisher(item, workflows, publishers) {
           `no workflow publishes ${item.name} to ${item.registry}; CI releases will not reach it`,
         ]
       : []),
-    ...secrets.map((secret) => tokenSecretWarning(item.registry, secret)),
+    ...secrets
+      .filter(() => publisher.policy !== "oidc-with-token-fallback")
+      .map((secret) => tokenSecretWarning(item.registry, secret)),
   ];
   if (warnings.length > 0) {
     result.warnings = [...(item.warnings ?? []), ...warnings];

package/src/flows.mjs

@@ -477,7 +477,7 @@ export function npmFlow(packageInfo, context) {
       "sign-out",
       "Sign out of npm",
       "command",
-      "Revoke the session token created by the web login.",
+      "With --sign-out, revoke the session token created by the web login now; otherwise the next run reuses it and npm ends it after two hours.",
       { command: command("npm", ["logout"]), when: "tool-signed-in" },
     ),
     removeWorktreeStep(),
@@ -555,7 +555,7 @@ function apiCratesFlow(packageInfo, context) {
       "crates-sign-out",
       "Sign the automated browser out of crates.io",
       "api",
-      "Remove the sign-in this run brought into the automated profile; --keep-session keeps it. No token outlives the run either way.",
+      "With --sign-out, remove the sign-in this run brought into the automated profile; otherwise the next run reuses it. No token outlives the run either way.",
       { when: "crates-signed-in" },
     ),
     removeWorktreeStep(),

package/src/github.mjs

@@ -1,3 +1,4 @@
+import { delay, retryDelay } from "./request-policy.mjs";
 import {
   createRestClient,
   resolveToken,
@@ -15,7 +16,9 @@ export function githubServices(options = {}) {
       "sign in to GitHub with gh auth login before scanning or setting secrets",
     );
   }
-  const rest = options.rest ?? createRestClient({ token });
+  const rest =
+    options.rest ??
+    createRestClient({ token, fetch: retryingGithubFetch(options) });
   const log = {
     debug: (message) => {
       if (options.verbose) {
@@ -41,3 +44,33 @@ export function githubServices(options = {}) {
     },
   };
 }
+
+/** Retry rate-limited reads before gh-manager consumes response headers. */
+export function retryingGithubFetch(options = {}) {
+  return async (url, init = {}) => {
+    const fetcher = options.githubFetch ?? globalThis.fetch;
+    for (let attempt = 0; ; attempt++) {
+      const response = await fetcher(url, init);
+      if (
+        ![403, 429].includes(response.status) ||
+        attempt >= 3 ||
+        !["GET", "HEAD"].includes(init.method ?? "GET")
+      ) {
+        return response;
+      }
+      const reset =
+        Number(response.headers?.get("x-ratelimit-reset")) * 1000 - Date.now();
+      const wait = Math.max(
+        retryDelay(response.headers?.get("retry-after"), attempt),
+        Number.isFinite(reset) ? reset : 0,
+      );
+      if (options.verbose) {
+        console.error(
+          `GitHub read rate limited (HTTP ${response.status}); retry ${attempt + 1} in ${wait}ms`,
+        );
+      }
+      await response.body?.cancel();
+      await (options.sleep ?? delay)(wait);
+    }
+  };
+}

package/src/migration-cleanup.mjs

@@ -36,11 +36,22 @@ export function publishedThroughOidc(job, log, registry) {
       ) && /Published\s+\S+\s+v\d/.test(log)
     );
   }
+  if (steps.some((step) => /token fallback/i.test(step.name))) {
+    return false;
+  }
   if (registry === "npm") {
-    return /^.*\+\s+(?:@[^/\s]+\/)?[^@\s]+@\d/m.test(log);
+    return (
+      steps.some((step) => /OIDC/i.test(step.name)) &&
+      /^.*\+\s+(?:@[^/\s]+\/)?[^@\s]+@\d/m.test(log)
+    );
   }
   if (registry === "pypi") {
-    return /Successfully uploaded|View at:\s*https:\/\/pypi\.org/.test(log);
+    return (
+      steps.some(
+        (step) =>
+          /prm_oidc|OIDC/i.test(step.name) && !/fallback/.test(step.name),
+      ) && /Successfully uploaded|View at:\s*https:\/\/pypi\.org/.test(log)
+    );
   }
   return false;
 }
@@ -80,13 +91,6 @@ export async function cleanupMigratedSecrets(session) {
   ];
   const current = await defaultWorkflows(github, slug);
   const stillRead = names.filter((name) => readsSecret(current.files, name));
-  if (stillRead.length) {
-    session.outcome = { status: "migration-required" };
-    console.log(
-      `${slug} still reads ${stillRead.join(", ")}; merge the conversion PR before cleanup.`,
-    );
-    return;
-  }
   const workflow = plan.trusted_publisher?.workflow ?? plan.package.workflow;
   const runs = await github.runs.list(slug, {
     workflow,
@@ -124,6 +128,24 @@ export async function cleanupMigratedSecrets(session) {
     );
     return;
   }
+  if (!options.deleteTokenSecrets) {
+    session.outcome = {
+      status: "fallback-retained",
+      oidc_verified: true,
+      fallback_secrets: stillRead,
+    };
+    console.log(
+      `${slug}: OIDC publication verified; token secrets (${stillRead.join(", ") || "none referenced"}) and expiry metadata retained for fallback. Use --delete-token-secrets only after removing every consumer.`,
+    );
+    return;
+  }
+  if (stillRead.length) {
+    session.outcome = { status: "migration-required" };
+    console.log(
+      `${slug} still reads ${stillRead.join(", ")}; merge the conversion PR before cleanup.`,
+    );
+    return;
+  }
   const deletions = [];
   for (const name of names) {
     const manager = github.secrets({ repo: slug });

package/src/organization-scan.mjs

@@ -52,6 +52,13 @@ export function packageFindings(inspection) {
         manifest: item.manifest,
       };
       const findings = [];
+      if (item.exists_on_registry === undefined && item.registry_http_status) {
+        findings.push({
+          ...common,
+          type: "registry-state-unknown",
+          evidence: { http_status: item.registry_http_status },
+        });
+      }
       if (item.exists_on_registry === false) {
         findings.push({ ...common, type: "unpublished" });
       }
@@ -267,14 +274,24 @@ async function releaseHealth(github, item, findings, onError) {
       }
       const runs = [];
       for (const event of ["push", "workflow_dispatch"]) {
-        runs.push(
-          ...(await github.runs.list(item.repository, {
+        let listed;
+        try {
+          listed = await github.runs.list(item.repository, {
             workflow,
             branch: item.default_branch,
             event,
             limit: 1,
-          })),
-        );
+          });
+        } catch (error) {
+          if (!/404/.test(error.message)) {
+            throw error;
+          }
+          listed = await github.runs.list(item.repository, {
+            workflow,
+            event,
+          });
+        }
+        runs.push(...listed);
       }
       const latest = runs
         .filter(
@@ -304,10 +321,17 @@ async function releaseHealth(github, item, findings, onError) {
         evidence,
       };
       findings.push(finding);
-      evidence.matches = await github.runs.logs(latest.id, {
-        repo: item.repository,
-        grep: RELEASE_FAILURE_PATTERNS,
-      });
+      evidence.matches = await github.runs
+        .logs(latest.id, {
+          repo: item.repository,
+          grep: RELEASE_FAILURE_PATTERNS,
+        })
+        .catch((error) => {
+          if (/GitHub log download (?:404|410)/.test(error.message)) {
+            return { status: "logs-expired", matches: [] };
+          }
+          throw error;
+        });
     } catch (error) {
       onError({ stage: "release", workflow, message: error.message });
     }
@@ -351,9 +375,11 @@ export function renderScan(scan) {
       const status =
         pkg.exists_on_registry === undefined
           ? "registry state unknown"
-          : pkg.trusted_publishing === true
-            ? "published with trusted publishing"
-            : "published; trusted publishing unknown";
+          : pkg.publishing_policy === "oidc-with-token-fallback"
+            ? "trusted publishing + token fallback"
+            : pkg.trusted_publishing === true
+              ? "published with trusted publishing"
+              : "published; trusted publishing unknown";
       rows.push(`${repo.repository}\t${pkg.registry}\t${pkg.name}\t${status}`);
     }
   }

package/src/organization-setup.mjs

@@ -144,8 +144,13 @@ export async function accountCommand(command, options, outputPlans) {
     if (errors.length) {
       console.error(renderScan({ repositories: errors, findings: [] }));
     }
-    if (options.migrate && errors.length) {
-      throw new Error("migration requires a complete account scan");
+    if (options.migrate) {
+      items = items.filter((item) => !item.error);
+      for (const item of errors) {
+        console.error(
+          `Skipping migration for ${item.repository}: ${item.error}`,
+        );
+      }
     }
     const packages = items.flatMap((item) => item.inspection.packages);
     const environment = await (options.probeEnvironment ?? probeEnvironment)({
@@ -247,9 +252,6 @@ export async function accountCommand(command, options, outputPlans) {
           "some repositories could not be prepared; see scan errors",
         );
       }
-      if (options.migrate && scan.repositories.some((item) => item.error)) {
-        throw new Error("migration requires a complete account scan");
-      }
     }
     const secretRepositories = {};
     for (const plan of plans) {

package/src/plan.mjs

@@ -75,7 +75,9 @@ function buildPlan(inspection, packageInfo, options) {
   if (
     (options.migrate || options.addPublishJob) &&
     ["crates-io", "npm", "pypi"].includes(packageInfo.registry) &&
-    packageInfo.token_secrets?.length
+    (packageInfo.publishing_policy
+      ? packageInfo.publishing_policy !== "oidc-with-token-fallback"
+      : packageInfo.token_secrets?.length)
   ) {
     return basePlan(inspection, packageInfo, [
       {
@@ -84,7 +86,7 @@ function buildPlan(inspection, packageInfo, options) {
         kind: "manual",
         confirm: true,
         description:
-          "Convert existing publishing jobs and reusable callers to OIDC, preserve the release commands and environment, and remove legacy token wiring. Review and merge the PR, then re-run setup --migrate to register trust and verify an OIDC release before deleting secrets.",
+          "Convert existing publishing jobs and reusable callers to OIDC, preserve the release commands and environment, and retain token secrets as fallback. Review and merge the PR, then re-run setup --migrate to register trust and verify an OIDC release while retaining fallback secrets by default.",
       },
     ]);
   }
@@ -241,6 +243,12 @@ function flowPlan(inspection, packageInfo, options) {
         : steps.filter((item) => !BOOTSTRAP_CONDITIONS.has(item.when)),
     );
   }
+  if (!options.deleteTokenSecrets) {
+    steps = steps.filter(
+      (step) =>
+        !["confirm-oidc-cleanup", "delete-token-secret"].includes(step.id),
+    );
+  }
   if (options.migrate) {
     steps = steps.filter(
       (step) =>
@@ -252,11 +260,11 @@ function flowPlan(inspection, packageInfo, options) {
     );
     steps.push({
       id: "cleanup-migrated-secrets",
-      title: "Verify OIDC publication and clean up legacy secrets",
+      title: "Verify OIDC publication and report fallback secrets",
       kind: "api",
       confirm: true,
       description:
-        "Read the default-branch workflows and successful publishing steps at its current commit. Delete repository token secrets only after verification; delete organization secrets only after a complete fresh scan proves no remaining consumer.",
+        "Read the default-branch workflows and successful publishing steps at its current commit. Retain token secrets and expiry metadata for fallback by default. With --delete-token-secrets, delete repository secrets only after verification and proof of non-use; delete organization secrets only after a complete fresh scan proves no remaining consumer.",
     });
   }
   if (options.ref) {