chore(deploy): rotate registry tokens through the workflow

[harlan-zw]

🔗 Linked issue

Follow-up to #595.

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

The registry fallback token expires soon and still handles reads denied by the GitHub App.
Add an explicit manual rotation option to the production deployment workflow.
It validates the replacement token before updating the Worker secret, then continues deployment and smoke checks.

📝 Migration

Set the repository Actions secret REGISTRY_GITHUB_TOKEN to a public-repository read token.
After merge, run:

gh workflow run deploy-cloudflare.yml --repo skilld-dev/skilld.dev --ref main -f target=site -f rotate_registry_github_token=true

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-09 04:51 UTC.

GitHub merged this pull request.

• Logged (25/100): Validation proves authentication, not the repository-read scope the fallback needs; as an optional follow-up, validate against a public repo read such as GET /repos/skilld-dev/skills before applying the secret. View code Optional follow-up.
  • Ask an agent to verify and fix this finding
• Logged (10/100): The rotation's wrangler call lacks the transient-fault retry the surrounding deploy steps already have, costing a full re-dispatch; optional follow-up is routing it through the same retry helper. View code Optional follow-up.
  • Ask an agent to verify and fix this finding
• Logged (10/100): The rotation flag is silently ignored when target=harness-proof; optional follow-up is a guard that fails or warns on that combination. View code Optional follow-up.
  • Ask an agent to verify and fix this finding
• Logged (5/100): The fetched token-owner JSON is dead output; optional follow-up is echoing the non-sensitive login field to $GITHUB_STEP_SUMMARY so each rotation records which account holds the token. View code Optional follow-up.
  • Ask an agent to verify and fix this finding
• Logged (10/100): Material documentation gap: the PR's only visual evidence is unavailable (HTTP 400), so the screenshot claim cannot be verified against the workflow implementation. View code Optional follow-up.
  • Ask an agent to verify and fix this finding

c881a828-5a4b-4de3-a912-6d7656eb514b

Selected findings run after merge and open separate pull requests.

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results