divekit credentials status

Report the managed credentials of a distribution

Synopsis

Report the managed credentials of a distribution without changing anything.

For each repository the report shows the token name, the project that owns the token (GitLab sends its expiry notices to that project), the project whose CI/CD variables carry it, the state and the expiry date. Token values are never shown.

STATES: active one active token, carried by every consuming variable expiring active, but it expires within 30 days expired the managed token ended by date missing no active managed token exists pending-cleanup several active tokens carry a managed name: a renewal stopped before it ended the older one legacy the only active token still has the legacy name variables-missing the token works, but a consuming variable does not exist unknown a project could not be read, which is never reported as healthy

The command exits with an error when a project could not be read, so a script does not mistake missing evidence for a healthy distribution.

Usage

divekit credentials status [flags]

Examples

# Report every credential
divekit credentials status -d ST2M4

# Report one repository as JSON
divekit credentials status -d ST2M4 --uuid abc123 --output-format json

# Only the tokens owned by the evaluation repositories
divekit credentials status -d ST2M4 --target eval

Flags

-d, --distribution string    Distribution name
      --output-format string   Report format: table (default) or json (default "table")
  -r, --remote string          Remote repository URL (e.g. GitLab instance)
      --target strings         Only credentials whose token belongs to a project of this target, for example work or eval (repeatable)
  -t, --token string           GitLab token or token file path (file:///...)
      --uuid strings           Only repositories with these UUIDs (repeatable or comma-separated)

Inherited Flags

-l, --loglevel string   log level (debug, info, warn, error, fatal) (default "info")
      --no-index          skip project index update
      --non-interactive   run in non-interactive mode (fails if interactive input is required)
  -y, --yes               assume yes/default for all prompts (non-interactive with automatic defaults)

Parent Command

divekit credentials