MIP-0086 task 11: retire MAROLA_CROSS_REPO_PAT, MAROLA_BUMP_PAT, STEWARD_GH_TOKEN and the old App names (a person)

What

The last step of MIP-0086, which grew out of this issue (its inventory is MIP-0086 §2 and its seven-App design was folded into two). Delete the PATs and old names only after every user has moved.

⚠️ A secret deleted while any workflow still names it breaks that workflow on its next run, in every repo at once. The preflight is not optional.

Acceptance criteria

preflight: a fresh clone of every repo's main names none of MAROLA_CROSS_REPO_PAT, MAROLA_BUMP_PAT, STEWARD_GH_TOKEN, GEMINI_APP_*, POINTER_SYNC_APP_* outside the devkit's two fallbacks (output pasted here)
every consumer pins a devkit with task 2's change
a devkit release removes notify-umbrella's token and gemini-review's GEMINI_* fallbacks, and its bumps merged
the secrets and variables deleted and the PATs revoked by their owners
PROFILE_DISPATCH_TOKEN recorded here as out of MIP-0086's scope

Named test

grep -rn 'secrets\.[A-Z_]*\(PAT\|_TOKEN\)' over every repo's .github/ lists only GITHUB_TOKEN, non-GitHub service tokens and PROFILE_DISPATCH_TOKEN (output pasted here).

MIP-0086 (#773 until it merges) owns the design and its tasks file the order; this issue owns the status. Blockers are native blocked by edges from the tasks file's depends on column.

notify-umbrella: dispatch with marola-pr-bot's key, not MAROLA_CROSS_…

Preflight, 2026-10-16 (after devkit v0.13.0 and its seven bump PRs merged). Fresh --depth 1 clones of every non-archived marola-dev repo's main: .github@90d6146, awesome-ocean-science@4fe2f7f, awesome-open-climate-science@00dee8c, marola@018c691, marola-agents@9cf178a, marola-app@1fcb929, marola-corpus@86ae0e6, marola-devkit@d4b1c05, marola-ml@80fbf58, marola-oods@6ab92fb, marola-research@d659c79, marola-site@e40d641, marola-skills@93a4fc9, open-sustainable-technology@5d2a59a (contato is private and empty).

No workflow names MAROLA_CROSS_REPO_PAT, MAROLA_BUMP_PAT, STEWARD_GH_TOKEN, GEMINI_APP_* or POINTER_SYNC_APP_*: grep -rln … --include='*.yml' */.github prints nothing. The devkit's two fallbacks are gone (notify-umbrella and gemini-review drop the pre-MIP-0086 fallbacks (token, GEMINI_APP_*) marola-devkit#132, in v0.13.0), and every consumer pins v0.13.0.
Text that still names them (no workflow reads it, so a delete breaks nothing): marola docs/3-Ways-of-working/CI-CD.md:103-104 and NEW-REPO.md:37,64,69 (MIP-0086 task 10: docs — the two Apps, the leak runbook, AUTO_MERGE, NEW-REPO #785 owns these); marola-devkit scripts/runner-preflight.sh:104-114 (advises setting STEWARD_GH_TOKEN; needs its own issue); marola-devkit docs/4-reference_workflows.md:377 (says passing GEMINI_APP_PRIVATE_KEY now fails: correct).

Named test, grep -rhoE 'secrets\.[A-Z_]*(PAT|_TOKEN)' */.github | sort | uniq -c:

  1 secrets.CLOUDFLARE_API_TOKEN
  1 secrets.GH_TOKEN
 14 secrets.GITHUB_TOKEN
  1 secrets.HF_TOKEN
  1 secrets.INMET_TOKEN
  1 secrets.MAPBOX_PUBLIC_TOKEN
  1 secrets.MASTODON_ACCESS_TOKEN
  1 secrets.PROFILE_DISPATCH_TOKEN

secrets.GH_TOKEN is open-sustainable-technology's publish.yml:34 (an awesome-list mirror; no such secret is set in the org or that repo): out of MIP-0086's scope, like PROFILE_DISPATCH_TOKEN.

What still exists and can go (read with gh secret list / gh variable list / the secrets' repository access):

org secrets MAROLA_CROSS_REPO_PAT (7 repos), MAROLA_BUMP_PAT (marola-devkit), STEWARD_GH_TOKEN (marola-app), GEMINI_APP_PRIVATE_KEY (7 repos)
org variable GEMINI_APP_ID (= 5180623, marola-pr-bot's own ID)
marola repo secrets STEWARD_GH_TOKEN, POINTER_SYNC_APP_KEY; repo variable POINTER_SYNC_APP_ID
org App installations today: claude, marola-pr-bot, marola-merge-bot (no marola-pointer-sync installation left)

PROFILE_DISPATCH_TOKEN is out of MIP-0086's scope (marola's profile-activity.yml; not set as an org or marola secret today).

Step "delete" done 2026-10-16 by a person; checked after: org secrets now BACKBLAZE_ETL_APP_KEY GEMINI_API_KEY HF_TOKEN MAPBOX_PUBLIC_TOKEN PR_BOT_KEY TAILSCALE_OAUTH_CLIENT_ID TAILSCALE_OAUTH_SECRET; org variables AUTO_MERGE BACKBLAZE_ETL_KEY_ID BACKBLAZE_ETL_KEY_NAME PR_BOT_APP_ID; marola repo secrets HF_TOKEN MERGE_BOT_KEY, variable MERGE_BOT_APP_ID. A one-day soak follows before the PATs are revoked and the old App key and App are removed.

runner-preflight drops the PR-creation check and its STEWARD_GH_TOKEN…

Soak, 2026-10-17 12:55Z (25 h after the delete). Nothing broke.

Fresh --depth 1 clones of every non-archived repo's main: .github@aa48b3c, marola@3d82ad0, marola-agents@9cf178a, marola-app@35d315b, marola-corpus@aa228e2, marola-devkit@b804e73 (v0.17.0), marola-ml@5ab6c90, marola-oods@c36860c, marola-research@041cedd, marola-site@a362876, marola-skills@8170eda and the three awesome lists (unchanged).

No workflow names an old secret or variable. The only text left is history: devkit CHANGELOG.md, the MIPs, and devkit docs/4-reference_workflows.md:406, which correctly says that passing GEMINI_APP_PRIVATE_KEY now fails.
The named test prints the same eight lines as yesterday: GITHUB_TOKEN ×14, PROFILE_DISPATCH_TOKEN, GH_TOKEN (open-sustainable-technology), and five non-GitHub service tokens.
Org secrets, org variables and marola's own secrets and variables are the same as after the delete. Installed Apps: claude, marola-pr-bot, marola-merge-bot.

Failed runs since 2026-10-16T11:45Z, across every repo (/actions/runs?created=>=…). None reads a deleted name:

run	cause
marola CI 39033395828	`python-ci` on `fix/870-ruff-submodule-excludes`, fixed in that PR
marola pointer-sync-merge 39032981368	#873 had a merge conflict
marola `profile-activity.yml` (×6)	starts no jobs; it already failed this way before the delete
marola-app docker smoke 38912815483	the live `--summarize` run was not ok
marola-site site health (×5)	`marola.dev/data/areas.json` returns 403
marola-skills refresh 39025670416	`GitHub Actions is not permitted to create or approve pull requests`; it has failed every day since at least 2026-10-10, so the delete did not cause it (marola-dev/marola-skills#32)

Owner steps, done 2026-10-17 by a person (the PATs and the App settings have no API a user token can reach, so these are as reported):

the three PATs that backed MAROLA_CROSS_REPO_PAT, MAROLA_BUMP_PAT and STEWARD_GH_TOKEN revoked
marola-pr-bot keeps one private key
the old marola-pointer-sync App deleted (GET /apps/marola-pointer-sync returns 404)

Every acceptance criterion is met; closing. MIP-0086 row 11 is done, which leaves #786.

Navigation Menu

Repository navigation

MIP-0086 task 11: retire MAROLA_CROSS_REPO_PAT, MAROLA_BUMP_PAT, STEWARD_GH_TOKEN and the old App names (a person) #765

What

Acceptance criteria

Named test

19 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

MIP-0086 task 11: retire MAROLA_CROSS_REPO_PAT, MAROLA_BUMP_PAT, STEWARD_GH_TOKEN and the old App names (a person) #765

Description

What

Acceptance criteria

Named test

Activity

19 remaining items

brunogbv commented on Oct 16, 2026

brunogbv commented on Oct 16, 2026

brunogbv commented on Oct 17, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions