rotato
Serverless secret/key rotation into Bitwarden Secrets Manager.
A scheduled Cloud Run job rotates an expiring credential (e.g. a GitLab PAT) and writes the fresh value back to Bitwarden. Every machine then fetches the current value on demand, so the secret is never written to disk and rotations are transparent.
Install
uv tool install rotato # or: pipx install rotato
Consumer usage (laptop / VM)
Bootstrap a machine once — no repo checkout required:
# GitLab PAT (or any Bitwarden token) as a git credential
rotato install <secret-uuid> --user <git-user>
# GitHub App mode: mint a short-lived installation token per git op
rotato install <pem-uuid> --github --app-id <id> --installation-id <id>
install writes this machine's read-only Bitwarden token to
~/.config/rotato/, records a friendly name -> uuid map, and points git's
credential helper at rotato. After that:
rotato fetch <name|uuid> # print a secret's current value, read-only
rotato github-token <name|uuid> --app-id <id> --installation-id <id>
git -C <a-repo> ls-remote # git now authenticates via Bitwarden
Server side
The rotation job runs as rotato run <rotator-name> (also the container
entrypoint); ROTATOR selects the rotator. Deploying the Cloud Run job,
scheduler, and alerting is covered in the full documentation.
Documentation
Full design, invariants, deployment, and "add a rotator" guide: README.org.
License
MIT.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file rotato-0.1.0.tar.gz.
File metadata
- Download URL: rotato-0.1.0.tar.gz
- Upload date:
- Size: 17.1 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
d5916c50a170722478c04109811fec1e467bb9b52feaaebf8f3dee2729c2abe0
|
|
| MD5 |
40d9a1de974fdb129f016691f9eed679
|
|
| BLAKE2b-256 |
fdbb77726ba84543bd4185b24e2f0abd1adc647edafcf30a4f2a374bbba36a4c
|
Provenance
The following attestation bundles were made for rotato-0.1.0.tar.gz:
Publisher:
publish.yml on gongzhitaao/rotato
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
rotato-0.1.0.tar.gz -
Subject digest:
d5916c50a170722478c04109811fec1e467bb9b52feaaebf8f3dee2729c2abe0 - Sigstore transparency entry: 2454458510
- Sigstore integration time:
-
Permalink:
gongzhitaao/rotato@9d9ac5f9fda2388062aab574e47aef266d78fd3d -
Branch / Tag:
refs/tags/0.1.0 - Owner: https://github.com/gongzhitaao
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@9d9ac5f9fda2388062aab574e47aef266d78fd3d -
Trigger Event:
release
-
Statement type:
File details
Details for the file rotato-0.1.0-py3-none-any.whl.
File metadata
- Download URL: rotato-0.1.0-py3-none-any.whl
- Upload date:
- Size: 21.6 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
38ce18f56f830037e9cad41095f05e46d309af56384a6d53756607ce03149558
|
|
| MD5 |
b86a8135d22afdb5313a02d2be819deb
|
|
| BLAKE2b-256 |
2a3f3f672fb1d848b572a4797aeae426f14761c8a087d04d32c69d9c0183daba
|
Provenance
The following attestation bundles were made for rotato-0.1.0-py3-none-any.whl:
Publisher:
publish.yml on gongzhitaao/rotato
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
rotato-0.1.0-py3-none-any.whl -
Subject digest:
38ce18f56f830037e9cad41095f05e46d309af56384a6d53756607ce03149558 - Sigstore transparency entry: 2454459013
- Sigstore integration time:
-
Permalink:
gongzhitaao/rotato@9d9ac5f9fda2388062aab574e47aef266d78fd3d -
Branch / Tag:
refs/tags/0.1.0 - Owner: https://github.com/gongzhitaao
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@9d9ac5f9fda2388062aab574e47aef266d78fd3d -
Trigger Event:
release
-
Statement type:
