divekit credentials renew

Replace the managed tokens of a distribution before they expire

Synopsis

Replace the managed tokens of a distribution before they expire.

For each credential Divekit creates a replacement token, writes it into every CI/CD variable that consumes it, and only then revokes the previous token, so pipelines keep working throughout. If a variable cannot be updated, the previous token stays valid and the credential is reported as failed. Running the renewal again finishes it and also removes the surplus token the failed attempt left.

EXPIRY: –expires-at 2027-04-21 an exact date in YYYY-MM-DD form, after today –lifetime 6mo counted from today in UTC: d days, w weeks, mo calendar months, y calendar years. A month keeps the day of the month and falls back to the last day of a shorter month, so 6mo from 31 August ends on the last day of February. Without either, tokens live 6 months, as distribution issues them. No token lives longer than 365 days, the default limit of GitLab, which would refuse a later date only after the plan was confirmed. A year that spans a leap day (1y, 12mo) ends 365 days out. An instance with a lower limit rejects a date inside ours when the first replacement is created, before anything changes.

The legacy token divekit-access-token served every link of its project. It ends only after every credential of that project was renewed in the run, so a link that fails or is not reached keeps the token it reads.

The plan is shown first and needs confirmation, also for a single repository, because a renewal changes CI/CD variables. –dry-run stops after the plan and –yes confirms without a prompt. Results are reported per repository; the failed ones are listed with the –uuid values that repeat the renewal for them. When a variable update ends without a clear answer, for example on a timeout, the replacement is kept next to the old token, because GitLab may have stored it. ‘credentials status’ then shows pending-cleanup and a repeated renewal finishes the job.

Usage

divekit credentials renew [flags]

Examples

# Renew everything for six months and review the plan first
divekit credentials renew -d ST2M4 --lifetime 6mo

# Renew until a fixed date, without a prompt
divekit credentials renew -d ST2M4 --expires-at 2027-04-21 --yes

# Preview the renewal of two repositories
divekit credentials renew -d ST2M4 --uuid abc123,def456 --dry-run

# Renew only the tokens the work repositories own
divekit credentials renew -d ST2M4 --target work --lifetime 90d

Flags

-d, --distribution string   Distribution name
  -n, --dry-run               Show the renewal plan without changing anything
      --expires-at string     Exact expiry date of the new tokens, YYYY-MM-DD, after today and at most 365 days away
      --lifetime string       Lifetime of the new tokens counted from today in UTC: a number and d, w, mo or y, for example 90d, 12w, 6mo, 1y, at most 365 days
  -r, --remote string         Remote repository URL (e.g. GitLab instance)
      --target strings        Only credentials whose token belongs to a project of this target, for example work or eval (repeatable)
  -t, --token string          GitLab token or token file path (file:///...)
      --uuid strings          Only repositories with these UUIDs (repeatable or comma-separated)

Inherited Flags

-l, --loglevel string   log level (debug, info, warn, error, fatal) (default "info")
      --no-index          skip project index update
      --non-interactive   run in non-interactive mode (fails if interactive input is required)
  -y, --yes               assume yes/default for all prompts (non-interactive with automatic defaults)

Parent Command

divekit credentials