[FAQ Compilation] Security Alert - Rotate any secrets stored in CircleCI

[emilycook]

What resources can help make this process faster?

Below is a tool for discovering all of your secrets on CircleCI. Note that this only works for GitHub users.

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

UPDATE: We have created a tool for discovering all your secrets on CircleCI. The difference between this and the BASH script originally posted is that this will support both repositories that are under an individual user’s GitHub account, and repositories that are under a GitHub organization. As mentioned earlier, the BASH script version only works for repositories listed under a given GitHub org. Original response We have created the following gist as a guide to output a list of projects an…

---

Here are some additional resources that may be helpful:

https://circleci.com/docs/api/v2/index.html#tag/Context

^ this API will be helpful for quickly cycling keys

For project env vars:

https://circleci.com/docs/api/v2/index.html#operation/listEnvVars

Customers can use the create endpoints with the same env var name to replace them:

https://circleci.com/docs/api/v2/index.html#operation/addEnvironmentVariableToContext

https://circleci.com/docs/api/v2/index.html#operation/createEnvVar

---

Listed below are some community-generated scripts you can use. We are still reviewing them as endorsed solutions.

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

I used the github CLI to get a list of all github repos gh api -H "Accept: application/vnd.github+json" '/orgs/ORG/repos?per_page=100&page=1' | jq 'map(.full_name) | .[]' -r > ./repos.txt gh api -H "Accept: application/vnd.github+json" '/orgs/ORG/repos?per_page=100&page=2' | jq 'map(.full_name) | .[]' -r >> ./repos.txt gh api -H "Accept: application/vnd.github+json" '/orgs/ORG/repos?per_page=100&page=3' | jq 'map(.full_name) | .[]' -r >> ./repos.txt gh api -H "Accept: application/vnd.github+jso…

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

I wrote a script. If it’s helpful then I’m happy.

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

For those working with circleCI and GitHub, here is a script we did today QuickStart python main.py list-ctx python main.py list-env python main.py list-keys python main.py replace-keys with the following main.py file import requests import argparse from config import API_TOKEN, GH_TOKEN, ORG # CircleCi api Token, Github api token, Github organisation name ORG_SLUG = f"github/{ORG}" auth_header = { 'Circle-Token': API_TOKEN } github_headers = { "X-GitHub-Api-Version": "2022-11-28", …

[CircleCI Security Alert] Rotate any secrets stored in CircleCI

In case it helps anybody else, I’ve produced this tool for listing my CircleCi secrets: GitHub - rupert-madden-abbott/circleci-audit Looks like CircleCI have their own tool now as well but it’s not clear to me what it covers. My tool handles: Project Env Vars, Keys and Jira Integration Context Env Vars