Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(secrets): Rotate secrets #8505

Merged
merged 8 commits into from
Oct 30, 2024
Merged

feat(secrets): Rotate secrets #8505

merged 8 commits into from
Oct 30, 2024

Conversation

aarushik93
Copy link
Contributor

Background

Changes πŸ—οΈ

Testing πŸ”

Note

Only for the new autogpt platform, currently in autogpt_platform/

  • Create from scratch and execute an agent with at least 3 blocks
  • Import an agent from file upload, and confirm it executes correctly
  • Upload agent to marketplace
  • Import an agent from marketplace and confirm it executes correctly
  • Edit an agent from monitor, and confirm it executes correctly

Configuration Changes πŸ“

Note

Only for the new autogpt platform, currently in autogpt_platform/

If you're making configuration or infrastructure changes, please remember to check you've updated the related infrastructure code in the autogpt_platform/infra folder.

Examples of such changes might include:

  • Changing ports
  • Adding new services that need to communicate with each other
  • Secrets or environment variable changes
  • New or infrastructure changes such as databases

@github-actions github-actions bot added platform/backend AutoGPT Platform - Back end size/m labels Oct 30, 2024
@github-actions github-actions bot added the platform/frontend AutoGPT Platform - Front end label Oct 30, 2024
@aarushik93 aarushik93 changed the title Aarushikansal/rotate secrets feat(secrets): Rotate secrets Oct 30, 2024
@aarushik93 aarushik93 marked this pull request as ready for review October 30, 2024 15:45
@aarushik93 aarushik93 requested review from a team as code owners October 30, 2024 15:45
@aarushik93 aarushik93 requested review from Swiftyos and kcze and removed request for a team October 30, 2024 15:45
Copy link

PR Reviewer Guide πŸ”

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 πŸ”΅πŸ”΅πŸ”΅βšͺβšͺ
πŸ§ͺΒ No relevant tests
πŸ”’Β Security concerns

Sensitive information exposure:
The PR introduces new environment files and secrets in various configuration files. While most of these appear to be encrypted, the autogpt_platform/frontend/.env.development file contains plaintext sensitive information, including API keys and URLs. This file should not be committed to version control and should be added to .gitignore to prevent accidental exposure.

⚑ Recommended focus areas for review

Security Concern
New secrets have been added to the production environment. Ensure these are properly encrypted and managed.

Configuration Change
New environment variables and secrets have been added to the development environment. Verify if these changes are intentional and properly configured.

Sensitive Information Exposure
A new development environment file has been added with potentially sensitive information. Ensure this file is not committed to version control and is properly gitignored.

@aarushik93 aarushik93 enabled auto-merge (squash) October 30, 2024 15:47
@aarushik93 aarushik93 merged commit fc0c3e3 into dev Oct 30, 2024
9 checks passed
@aarushik93 aarushik93 deleted the aarushikansal/rotate-secrets branch October 30, 2024 15:55
aarushik93 added a commit that referenced this pull request Oct 30, 2024
* reseal secrets

* update DB url

* rotate prod db

* rotate prod

* rotate server

* builder valuse

* public env vars in env files

* public env vars in env files
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
platform/backend AutoGPT Platform - Back end platform/frontend AutoGPT Platform - Front end Review effort [1-5]: 3 size/m
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants