t18697: aidevops secret dependents: show what uses a credential before rename, rotation or revocation by marcusquinn · Pull Request #34733 · marcusquinn/aidevops

marcusquinn · 2026-10-15T00:25:38Z

Summary

Stacked on #34732 (t18696), which is stacked on #34726 (t18695). Base is the #34732 branch, so this diff shows only the dependents work.

Adds aidevops secret dependents NAME [--json]: a local, read-only answer to "what uses this credential?" before a rename, rotation or revocation. It searches the name and its declared aliases (and works when given an alias).

Source	How
Every repo in `~/.config/aidevops/repos.json` and all its linked worktrees	`git grep -F --untracked` (honours `.gitignore`), 30 s timeout per worktree, parallel
`~/.aidevops/agents/custom/`	bounded walk (5000 files)
`~/.config/aidevops/*.json\|conf\|toml\|yaml` (e.g. `site-inventory.json` `credential_env`)	file scan; the registry itself is excluded
`~/Library/LaunchAgents/.plist` (binary plists decoded), `~/.config/systemd/user/`, `crontab -l`	file/command scan

Safety properties:

No values, no network: it reads no secret store and outputs locations only (path:line and the matched name). Line text is used for classification and never returned, so values in scanned files cannot leak.
Never claims "unused" without evidence: lines that build a name dynamically ("CLOUDFLARE_${ACCOUNT}_API_TOKEN", concatenation, f-strings, %s/.format) are reported as possible-dynamic and set complete: false. Timeouts, truncation and unreadable files do the same. "No references found" is printed only for a complete, empty result.
Literal matches are token-exact, so CLOUDFLARE_API_TOKEN does not match CLOUDFLARE_ACME_API_TOKEN.

Files

.agents/scripts/credential_inventory_scan.py (new): needle building, literal/dynamic classification, bounded git grep/file scanning; one subprocess site with an absolute executable (# nosec B603).
.agents/scripts/credential_inventory_dependents.py (new): source discovery (repos/worktrees, custom agents, configs, schedulers, crontab), report and text rendering.
.agents/scripts/credential_inventory_names.py: related_names (canonical first, then aliases).
.agents/scripts/credential_inventory.py: dependents subcommand.
.agents/scripts/secret-helper.sh: dispatch and help line.
.agents/tools/credentials/credential-inventory.md: Quick Reference rule ("run dependents before renaming/rotating/revoking; only trust complete: true") and a "Dependents" section.

Verification

Isolated-HOME runtime script: two git repos (one with a linked worktree), custom agent, site-inventory.json, a binary LaunchAgent plist, and a canonical name plus an alias:

Literal hits found in a tracked file, an untracked file, the linked worktree, the custom agent, the config (via the alias) and the binary plist; the gitignored file was not reported.
CLOUDFLARE_${ACCOUNT}_API_TOKEN and f"CLOUDFLARE_{acct}_API_TOKEN" were reported as possible-dynamic, giving complete: false and an INCOMPLETE warning.
A fake value placed on a matching line does not appear in the JSON output.
After removing the dynamic lines, the result is complete: true with 7 literal hits.
An unreferenced name prints "No references found in the scanned sources."
Querying by alias returns the canonical name with its aliases.
ShellCheck, py_compile and markdownlint are clean.

Regression Evidence

This is not a platform fix. systemd, cron and LaunchAgent are mentioned only as read-only scan locations for a new command, and no platform-specific behaviour changes. No repository test was added: under the repo's test policy (reference/ci-gate-policy.md), the new feature was verified through the product path with an isolated-HOME runtime fixture (see Verification). That fixture covered a binary plist, linked worktrees, ignored and untracked files, dynamic name construction, and no value leakage. Existing test-secret-helper.sh passes 26/26.

aidevops.sh v3.39.31 plugin for OpenCode v1.19.0 with claude-opus-5-5 spent 54m and 274,339 tokens on this with the user in an interactive session.

…(GH#34717)

… threshold (GH#34717)

…dules under qlty file-complexity (GH#34717)

…jection (GH#34718)

…, GH#34717)

…607)

…ory-multi-account-provi' into feature/gh34718-credential-aliases-defaults-injection # Conflicts: # .agents/scripts/credential_inventory.py

…es-defaults-injection' into feature/gh34719-credential-dependents

coderabbitai · 2026-10-15T00:25:48Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 1

🚫 Excluded labels (none allowed): 1

no-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: marcusquinn/aidevops/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 9887ad50-eefd-468d-a322-458b4a868831

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codacy-production · 2026-10-15T00:26:53Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 124 complexity

Metric Results

Complexity 124

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

github-actions · 2026-10-15T00:26:56Z

Qlty New-File Smell Gate

✅ Clean — 2 new source file(s) scanned, no smells found.

Base (`c304f69`)	Head (`ada2adf`)	New files	Smells
		2	0

New files scanned

.agents/scripts/credential_inventory_dependents.py
.agents/scripts/credential_inventory_scan.py

github-actions · 2026-10-15T00:27:56Z

Qlty Smell Regression Gate

✅ No change — smell count unchanged.

Metric	Base (`c304f69`)	Head (`ada2adf`)	Delta
Total smells	65	65	+0

…ory-multi-account-provi' into feature/gh34718-credential-aliases-defaults-injection # Conflicts: # .agents/scripts/credential_inventory.py

…es-defaults-injection' into feature/gh34719-credential-dependents

…ntial-dependents # Conflicts: # .agents/scripts/credential_inventory.py # .agents/scripts/credential_inventory_names.py # .agents/scripts/secret-helper.sh # .agents/tools/credentials/credential-inventory.md # TODO.md

github-actions · 2026-10-15T01:19:12Z

Markdown Lint (changed-line scoped)

No new violations in changed lines (0 pre-existing in touched files — ignored).

Metric	Base (`c304f69`)	Head (`ada2adf`)
Total in touched files	—	0
New (in changed lines)	—	0

github-actions · 2026-10-15T01:20:13Z

Shell Function Complexity Regression Gate

✅ No regression — no new function(s) >100 lines.

Metric	Base (`c304f69`)	Head (`ada2adf`)
Total function(s) >100 lines	0	0

github-actions · 2026-10-15T01:20:15Z

Bash 3.2 Compatibility Regression Gate

✅ No regression — no new bash 3.2-incompatible construct(s).

Metric	Base (`c304f69`)	Head (`ada2adf`)
Total bash 3.2-incompatible construct(s)	0	0

+        except Exception:  # noqa: BLE001 - malformed plist falls back to raw text
+            pass


github-actions · 2026-10-15T01:22:57Z

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

SonarCloud: 0 bugs, 0 vulnerabilities, 1 code smells

Thu Oct 15 01:20:40 UTC 2026: Code review monitoring started
Thu Oct 15 01:20:40 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 1
Thu Oct 15 01:22:48 UTC 2026: Codacy analysis completed - issues found (exit 2)

📈 Current Quality Metrics

BUGS: 0
CODE SMELLS: 1
VULNERABILITIES: 0

Generated on: Thu Oct 15 01:22:49 UTC 2026

Generated by AI DevOps Framework Code Review Monitoring

github-actions · 2026-10-15T01:24:28Z

Shell Nesting Depth Regression Gate

✅ No regression — no new file(s) with nesting depth >8.

Metric	Base (`c304f69`)	Head (`ada2adf`)
Total file(s) with nesting depth >8	0	0

github-actions · 2026-10-15T01:24:38Z

File Size Regression Gate

✅ No regression — no new non-README Markdown file(s) >1000 lines at root / >500 elsewhere.

Metric	Base (`c304f69`)	Head (`ada2adf`)
Total non-README Markdown file(s) >1000 lines at root / >500 elsewhere	0	0

… (GH#34719)

…ntial-dependents

github-actions · 2026-10-15T01:34:52Z

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

SonarCloud: 0 bugs, 0 vulnerabilities, 1 code smells

Thu Oct 15 01:32:19 UTC 2026: Code review monitoring started
Thu Oct 15 01:32:19 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 1
Thu Oct 15 01:34:42 UTC 2026: Codacy analysis completed - issues found (exit 2)

📈 Current Quality Metrics

BUGS: 0
CODE SMELLS: 1
VULNERABILITIES: 0

Generated on: Thu Oct 15 01:34:42 UTC 2026

Generated by AI DevOps Framework Code Review Monitoring

Planning-Publication-ID: cffea7ba4242bd0c1ad21efc838b70488db72008 Planning-Publication-Handoff-ID: 850a821abc7577bbb0648a754dd6e21a19e137bd

Planning-Publication-ID: cffea7ba4242bd0c1ad21efc838b70488db72008 Planning-Publication-Handoff-ID: 850a821abc7577bbb0648a754dd6e21a19e137bd Co-authored-by: GitHub Actions <actions@github.com>

marcusquinn added 9 commits October 15, 2026 01:09

feat: non-secret credential registry with explicit provider defaults …

ed8529c

…(GH#34717)

refactor: extract set option parsing to keep cmd_set under complexity…

eb5ee33

… threshold (GH#34717)

refactor: split credential registry into fields/schema/names/store mo…

07452c7

…dules under qlty file-complexity (GH#34717)

feat: resolve credential aliases and explicit provider defaults at in…

8dec64c

…jection (GH#34718)

feat: add read-only credential dependents search (GH#34719)

7c99643

fix: use absolute bash for inventory subprocess (CodeFactor B603/B607…

32b54b7

…, GH#34717)

fix: resolve git/crontab to absolute paths in dependents scan (B603/B…

87defc9

…607)

Merge remote-tracking branch 'origin/bugfix/gh34680-credential-invent…

0a86701

…ory-multi-account-provi' into feature/gh34718-credential-aliases-defaults-injection # Conflicts: # .agents/scripts/credential_inventory.py

Merge remote-tracking branch 'origin/feature/gh34718-credential-alias…

19a55de

…es-defaults-injection' into feature/gh34719-credential-dependents

marcusquinn added the origin:interactive Created by interactive user session label Oct 15, 2026

vladimirdulov mentioned this pull request Oct 15, 2026

[Supervisor:vladimirdulov] 1 open PR, 0 issues assigned, 0 local workers — changed 2026-10-16 09:57 UTC #23855

Open

marcusquinn added 4 commits October 15, 2026 01:32

fix: annotate subprocess import (Bandit B404, GH#34717)

c2ae420

Merge remote-tracking branch 'origin/bugfix/gh34680-credential-invent…

fc602c9

…ory-multi-account-provi' into feature/gh34718-credential-aliases-defaults-injection # Conflicts: # .agents/scripts/credential_inventory.py

Merge remote-tracking branch 'origin/feature/gh34718-credential-alias…

733e019

…es-defaults-injection' into feature/gh34719-credential-dependents

fix: annotate subprocess imports (Bandit B404, GH#34719)

0c43452

marcusquinn mentioned this pull request Oct 15, 2026

t18699: One credential naming convention; record account metadata at creation #34739

Merged

marcusquinn marked this pull request as ready for review October 15, 2026 01:01

marcusquinn changed the base branch from feature/gh34718-credential-aliases-defaults-injection to main October 15, 2026 01:15

github-advanced-security Bot found potential problems Oct 15, 2026

View reviewed changes

Comment thread .agents/scripts/credential_inventory_scan.py Outdated

Comment on lines +145 to +146

except Exception: # noqa: BLE001 - malformed plist falls back to raw text

pass

marcusquinn added 2 commits October 15, 2026 02:27

fix(credentials): narrow plist fallback exceptions in dependents scan…

93c09e1

… (GH#34719)

Merge remote-tracking branch 'origin/main' into feature/gh34719-crede…

ada2adf

…ntial-dependents

marcusquinn merged commit 7feecf4 into main Oct 15, 2026
54 checks passed

marcusquinn deleted the feature/gh34719-credential-dependents branch October 15, 2026 01:40

github-actions Bot added the status:done Task is complete label Oct 15, 2026

github-actions Bot mentioned this pull request Oct 15, 2026

t18697: aidevops secret dependents: show what uses a credential before rename, rotation or revocation #34719

Closed

3 tasks

marcusquinn pushed a commit that referenced this pull request Oct 15, 2026

chore: mark t18697 complete (pr:#34733 completed:2026-10-15)

89eafd1

Planning-Publication-ID: cffea7ba4242bd0c1ad21efc838b70488db72008 Planning-Publication-Handoff-ID: 850a821abc7577bbb0648a754dd6e21a19e137bd

marcusquinn mentioned this pull request Oct 15, 2026

Multi-account providers: credentials become unidentifiable as an operator grows from one account to many #34680

Closed

Navigation Menu

Repository navigation

t18697: aidevops secret dependents: show what uses a credential before rename, rotation or revocation - #34733

t18697: aidevops secret dependents: show what uses a credential before rename, rotation or revocation#34733
marcusquinn merged 16 commits into
mainfrom
feature/gh34719-credential-dependents

marcusquinn commented Oct 15, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

Review skipped

Uh oh!

codacy-production Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		except Exception: # noqa: BLE001 - malformed plist falls back to raw text
		pass

Conversation

marcusquinn commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Files

Verification

Regression Evidence

Uh oh!

coderabbitai Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

codacy-production Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Qlty New-File Smell Gate

New files scanned

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Qlty Smell Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Markdown Lint (changed-line scoped)

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Shell Function Complexity Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bash 3.2 Compatibility Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026

🔍 Code Quality Report

📈 Current Quality Metrics

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Shell Nesting Depth Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

File Size Regression Gate

Uh oh!

github-actions Bot commented Oct 15, 2026

🔍 Code Quality Report

📈 Current Quality Metrics

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

marcusquinn commented Oct 15, 2026 •

edited

Loading

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

codacy-production Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading