- Visibility: Public
- Maintainer: @samuelho-dev (solo)
- Contributions: Not accepted
| Secret | Purpose | Permissions |
|---|---|---|
B2_ACCESS_KEY_ID |
B2 S3 API access | Write: ai-dev-env/nix/cache |
B2_SECRET_ACCESS_KEY |
B2 S3 API secret | Write: ai-dev-env/nix/cache |
NIX_SIGNING_KEY |
Package signing | Sign: Nix store paths |
Source: 1Password (Dev/backblaze)
Secrets accessible only when:
github.event_name == 'push'
&& github.ref == 'refs/heads/main'
&& inputs.skip_cache_push != 'true'- CODEOWNERS: Workflow files require approval
- Fork PR Approval: External workflows blocked
- Secret Hygiene: Keys shredded after use (
shred -u)
- Revoke B2 key via 1Password/B2 console
- Generate new Nix signing keypair
- Delete GitHub secrets:
gh secret delete <name> - Update 1Password with new credentials
- Re-add secrets to GitHub
- Revert:
git revert <sha> && git push --force - Audit:
gh run list --limit 20 - Check B2 for unauthorized uploads
- Secret Rotation: Every 90 days
- Audit Frequency: Monthly B2 cache review
- Contact: @samuelho-dev via GitHub Issues
Last updated: 2025-12-04