First, sorry to hear you've been sick! And glad you are on the mend!

I guess it depends on what doors your secrets unlock. If it is only clojars tokens, I guess you'd notice someone else deploying an artifact.

all my circleci tokens are scoped to individual projects

Mine too

and only give access to deploying on clojars

What about github tokens? If you are using those, depending on the access they grant, might be worth changing?

ah drat, you're right

this will take me 3 days to change the whole shebang, damnit

:sad panda:

yeah, the borkverse is vast, it does suck

The Circle Deploy key should be safe?

deploy key?

ok, I'm not using those I think

I think you are (by default) when you set up a project in Circle?

oh yes, I see now

I'll replace those env vars as best as a I can then... :grumble:

But normally, these seem to be read only keys (unless you’ve given more privilges) and AFAICT, the leakage of these shouldn’t matter for public repos.

I think you are right @slipset, https://github.blog/2015-06-16-read-only-deploy-keys/. So basically they grant ssh clone privs?

That’s my understanding, so they shouldn’t be a problem unless there are private repos involved, which clj-commons have none.

well, I re-configured a bunch of things and removed all my old tokens, so next time I'm about to deploy and something fails, I'm forced to create a new token

But you won’t remember why nor how 😕

It doesn't matter, I'll just make a new one

And you’ll be on your lawn yelling at the clouds.

yep

but not all on the same day :-D