| name | rotate-key |
| description | Guided key rotation. Updates /app/.env, syncs to GitHub Secrets, restarts gateway, and verifies. Invoke with /rotate <keyname>. |
| version | 1.0.0 |
| author | repo-man |
| tags | ["security","keys","rotation"] |
rotate-key
Invoke
/rotate <KEYNAME>
Example: /rotate OPENCLAW_PROD_ANTHROPIC_KEY
Pre-flight
- Confirm keyname is in canonical list. If not: WARN and ask Robert to confirm before proceeding.
- Ask Robert for the new key value (do not echo it back, do not log it, do not store it anywhere except /app/.env and GH Secret)
Steps
1. Backup current .env first
Run env-backup skill before making any changes. If env-backup fails: STOP, log ERROR, do not proceed.
2. Update /app/.env
sed -i "s|^<KEYNAME>=.*|<KEYNAME>=<new_value>|" /app/.env
grep -E "^<KEYNAME>=.+" /app/.env
If verification fails: log FATAL "Key not written correctly to .env", STOP.
3. Update GitHub Secret
gh secret set <KEYNAME> --body "<new_value>" --repo Supernor/openclaw-config
4. Restart gateway
docker restart openclaw-openclaw-gateway-1
sleep 5
docker ps | grep openclaw-gateway
5. Verify gateway is healthy
6. Run key-drift-check
7. Run env-backup
Completion Report
Success: [Repo-Man] rotate-key COMPLETE. <KEYNAME> rotated. Gateway restarted. Drift check: ✅. GitHub Secret: ✅.
Partial: [Repo-Man] rotate-key PARTIAL. <KEYNAME> updated in .env. GitHub Secret update FAILED. Gateway: ✅. Manual GH Secret update required.
Failed: [Repo-Man] ⚠️ rotate-key FAILED at step <N>. Gateway may be affected. Check logs immediately.
