divekit credentials revoke
Synopsis
Revoke the managed tokens of a distribution and remove the variables that carried them.
Tokens are revoked first and the variables removed afterwards. If a step fails, a consumer is left with a variable that holds a dead token, which fails closed, instead of a live secret that nothing references. A token that cannot be revoked keeps its variables in place. Running the revocation again finishes it.
After a revocation the pipelines that read these variables can no longer reach the other repository. ‘divekit credentials renew’ creates the credentials again. The legacy token divekit-access-token ends once every credential of its project was revoked in the run.
The plan is shown first and needs confirmation, also for a single repository. –dry-run stops after the plan and –yes confirms without a prompt.
Usage
divekit credentials revoke [flags]
Examples
# Revoke the credentials of one repository
divekit credentials revoke -d ST2M4 --uuid abc123
# Show what a bulk revocation would do
divekit credentials revoke -d ST2M4 --dry-run
# Revoke every credential of the distribution without a prompt
divekit credentials revoke -d ST2M4 --yes
Flags
-d, --distribution string Distribution name
-n, --dry-run Show the revocation plan without changing anything
-r, --remote string Remote repository URL (e.g. GitLab instance)
--target strings Only credentials whose token belongs to a project of this target, for example work or eval (repeatable)
-t, --token string GitLab token or token file path (file:///...)
--uuid strings Only repositories with these UUIDs (repeatable or comma-separated)
Inherited Flags
-l, --loglevel string log level (debug, info, warn, error, fatal) (default "info")
--no-index skip project index update
--non-interactive run in non-interactive mode (fails if interactive input is required)
-y, --yes assume yes/default for all prompts (non-interactive with automatic defaults)