Prompt for GitHub access token expiration duration during rotation#6644
Open
garath wants to merge 4 commits into
Open
Prompt for GitHub access token expiration duration during rotation#6644garath wants to merge 4 commits into
garath wants to merge 4 commits into
Conversation
The github-access-token secret type hard-coded a 90-day expiration (display only) and a fixed 30-day rotation with ExpiresOn set to MaxValue. Operators now enter the token's expiration duration (1-366 days) interactively during rotation. The entered value drives the on-screen GitHub instructions, the secret's ExpiresOn (now + duration), and NextRotationOn (rotate when ~1/3 of the duration remains). Adds unit tests for the duration validation and rotation-date math and documents the prompt in the Readme. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fa7e69fb-9fb8-400c-b4db-765ff4282ca4
Durations below 7 days are now rejected, printing the validation error and re-prompting. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fa7e69fb-9fb8-400c-b4db-765ff4282ca4
GitHub permits longer lifetimes, but we deliberately cap access token expiration at 30 days. Durations above 30 are rejected with the validation error. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fa7e69fb-9fb8-400c-b4db-765ff4282ca4
Use explicit types instead of var in GitHubAccessToken.cs and GitHubAccessTokenTests.cs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fa7e69fb-9fb8-400c-b4db-765ff4282ca4
There was a problem hiding this comment.
Pull request overview
Updates the github-access-token secret rotation flow to capture a user-entered expiration duration (in days) during interactive rotation, and uses it to compute the secret’s ExpiresOn and NextRotationOn along with updated operator guidance.
Changes:
- Prompt for GitHub token expiration duration (7–30 days) during rotation and apply it to
ExpiresOn/NextRotationOn. - Update operator guidance text to reflect the chosen expiration duration and scheduled next rotation date.
- Add unit tests for expiration duration parsing and rotation scheduling math.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/SecretManager/Microsoft.DncEng.SecretManager/SecretTypes/GitHubAccessToken.cs | Prompts for expiration duration, computes expiration/rotation dates, and prints updated instructions. |
| src/SecretManager/Microsoft.DncEng.SecretManager/Readme.md | Documents the new expiration-duration prompt and rotation timing. |
| src/SecretManager/Microsoft.DncEng.SecretManager.Tests/GitHubAccessTokenTests.cs | Adds tests for duration validation and NextRotationOn computation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+56
to
+61
| // Rotate once roughly two thirds of the way through the token's lifetime, | ||
| // i.e. when about one third of the entered duration remains before expiration. | ||
| protected static DateTimeOffset ComputeNextRotationOn(DateTimeOffset now, int expirationInDays) | ||
| { | ||
| return now.AddDays(expirationInDays * 2 / 3); | ||
| } |
Comment on lines
+344
to
+347
| During rotation you will be prompted to enter the token's expiration duration in | ||
| days (7-30). The entered duration is shown in the on-screen instructions for | ||
| creating the token on github.com and also sets the secret's expiration; the | ||
| secret is scheduled to rotate once about one third of that duration remains. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
github-access-tokenSecretManager secret type previously hard-coded a 90-day expiration (display only) and a fixed 30-day rotation, withExpiresOnset toDateTimeOffset.MaxValue. Operators now enter the token's expiration duration in days interactively during rotation, and that value drives the on-screen GitHub instructions, the secret's realExpiresOn, and itsNextRotationOn.Changes
SecretTypes/GitHubAccessToken.csPromptAndValidateAsync<int>helper.ExpiresOn = now + duration;NextRotationOn = now + duration * 2/3(rotate when ~1/3 of the lifetime remains).HumanInterventionRequiredException; PAT length check and login flow unchanged.var).Readme.md— documents the new prompt and the 7–30 day range.Microsoft.DncEng.SecretManager.Tests/GitHubAccessTokenTests.cs— 17 tests covering duration-bound validation (min/max/negative/non-numeric/non-integer) and the rotation/expiration date math.Validation
dotnet testonMicrosoft.DncEng.SecretManager.Tests(filtered toGitHubAccessTokenTests): 17 passed, 0 failed.