rotato
Serverless secret/key rotation into Bitwarden Secrets Manager.
A scheduled Cloud Run job rotates an expiring credential (e.g. a GitLab PAT) and writes the fresh value back to Bitwarden. Every machine then fetches the current value on demand, so the secret is never written to disk and rotations are transparent.
Install
uv tool install rotato # or: pipx install rotato
Consumer usage (laptop / VM)
Register a secret on the machine, then use it — no repo checkout required.
# a plain token (e.g. a GitLab PAT)
rotato install <secret-uuid> --name gitlab-pat
# a GitHub App private key (a short-lived installation token is minted on use)
rotato install <pem-uuid> --name gh --github --app-id <id> --installation-id <id>
install records the secret (and, on first run, prompts for this machine's
read-only Bitwarden token). Then:
rotato print <name|uuid> # print the usable credential to stdout
rotato list secrets # what's installed here
rotato list rotators # rotators this build supports
Wire git to an installed secret (writes a credential helper that calls
rotato print, so rotations are picked up automatically):
rotato setup gitlab <name> --user <git-user> # gitlab.com
rotato setup github <name> # github.com (App installation token)
rotato setup git <name> --user <u> --host <h> # any git host
git -C <a-repo> ls-remote # git now authenticates via Bitwarden
Server side
rotato refresh <rotator-name> runs a rotator (the Cloud Run job entrypoint):
read current → rotate at the provider → write back to Bitwarden → verify.
ROTATOR env selects the rotator.
Documentation
Full design, invariants, deployment, and "add a rotator" guide: README.org.
License
MIT.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file rotato-0.2.0.tar.gz.
File metadata
- Download URL: rotato-0.2.0.tar.gz
- Upload date:
- Size: 18.6 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
3b27fdb7283964efd106c0b9b60af8419ed52bc4c53be322173756c1f0c6d288
|
|
| MD5 |
6232f2b7e372afc828792bcccc2da9ac
|
|
| BLAKE2b-256 |
d74772bad96a21aa0b3ca7fe6cbd3fd2d43af4e05a704b67de0a570fb48227f2
|
Provenance
The following attestation bundles were made for rotato-0.2.0.tar.gz:
Publisher:
publish.yml on gongzhitaao/rotato
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
rotato-0.2.0.tar.gz -
Subject digest:
3b27fdb7283964efd106c0b9b60af8419ed52bc4c53be322173756c1f0c6d288 - Sigstore transparency entry: 2457647304
- Sigstore integration time:
-
Permalink:
gongzhitaao/rotato@29f77bcd59a13f640d288049bfb5e50e262de1dc -
Branch / Tag:
refs/tags/0.2.0 - Owner: https://github.com/gongzhitaao
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@29f77bcd59a13f640d288049bfb5e50e262de1dc -
Trigger Event:
release
-
Statement type:
File details
Details for the file rotato-0.2.0-py3-none-any.whl.
File metadata
- Download URL: rotato-0.2.0-py3-none-any.whl
- Upload date:
- Size: 23.6 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
aea2876735516302be42df069df0426aaf4bb18e7ec37a43dd1a0ca78a856ea7
|
|
| MD5 |
c817163a2a64abf3debec9396ed683be
|
|
| BLAKE2b-256 |
6ce6b27851f4d40e6bb2de6627037b4406d0d588c3133bef39400412a399b82a
|
Provenance
The following attestation bundles were made for rotato-0.2.0-py3-none-any.whl:
Publisher:
publish.yml on gongzhitaao/rotato
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
rotato-0.2.0-py3-none-any.whl -
Subject digest:
aea2876735516302be42df069df0426aaf4bb18e7ec37a43dd1a0ca78a856ea7 - Sigstore transparency entry: 2457647358
- Sigstore integration time:
-
Permalink:
gongzhitaao/rotato@29f77bcd59a13f640d288049bfb5e50e262de1dc -
Branch / Tag:
refs/tags/0.2.0 - Owner: https://github.com/gongzhitaao
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
publish.yml@29f77bcd59a13f640d288049bfb5e50e262de1dc -
Trigger Event:
release
-
Statement type:
