chore: drop unused Grafana token; rotate CF service token secret

AGENTS.md

@@ -63,24 +63,19 @@ Dependabot: they are owned by the canonical config in
 
 When Dependabot opens a PR, the managed caller workflow
 (`.github/workflows/dependabot-notify.yml`, from `gh-dependabot.tf`) invokes
-the `dependabot-notify` reusable workflow in `shared-workflows`, which posts a
-synthetic alert to the cluster Grafana's Alertmanager API. Delivery goes to
-Discord via the `GrafanaContactPoint`/`GrafanaNotificationPolicy` CRs in
-`kustomize-cluster/workloads/grafana`.
-
-Two secrets make this work, both distributed here to all active repositories:
-
-- `CLOUDFLARE_AUTH_CLIENT_ID` / `CLOUDFLARE_AUTH_CLIENT_SECRET` — the existing
-  "GitHub Actions" Cloudflare Access service token, allowed by the path-scoped
-  Access app managed in `tfroot-cloudflare/cf-access-grafana.tf`.
-- `GRAFANA_ALERTS_TOKEN` — a Grafana service account token. The account and
-  token are managed as code by the `GrafanaServiceAccount` CR in
-  `kustomize-cluster/workloads/grafana/serviceaccount-alerts.yaml`; the
-  operator writes the generated token to the `grafana-alerts-token` cluster
-  Secret (key `token`). Until that value is copied here into
-  `secrets/secrets.yaml` as `grafana_alerts_token`, the distributed secret is
-  a placeholder and alert delivery fails with a 401 in the caller repo's
-  Actions log.
+the `dependabot-notify` reusable workflow in `shared-workflows`
+(`.github/workflows/_dependabot-notify.yml` — the underscore path keeps it
+clear of this managed file's target, which is written to every repository
+including `shared-workflows`), which posts a
+synthetic alert to the cluster Alertmanager (`alertmanager.makeitwork.cloud`,
+kube-prometheus-stack) behind the Cloudflare Access app managed in
+`tfroot-cloudflare/cf-access-alertmanager.tf`. Delivery goes to Discord via
+the Alertmanager config Secret in `kustomize-cluster/operators/kube-prometheus-stack`.
+
+The only required secrets are `CLOUDFLARE_AUTH_CLIENT_ID` /
+`CLOUDFLARE_AUTH_CLIENT_SECRET` — the "GitHub Actions" Cloudflare Access
+service token, distributed here to all active repositories. Alertmanager has
+no auth of its own; the Access app is the only gate.
 
 ## Related Repositories
 

gh-dependabot.tf

@@ -72,8 +72,11 @@ resource "github_repository_file" "dependabot" {
 
 locals {
   # Caller for the dependabot-notify reusable workflow in shared-workflows.
+  # The reusable lives at _dependabot-notify.yml because this file's target
+  # path is managed in every repo, shared-workflows included; a reusable at
+  # the caller's path would be overwritten by this resource on every apply.
   # Fires only when Dependabot itself opens the PR; posts a synthetic alert
-  # to the cluster Grafana (see AGENTS.md, "Dependabot PR Alerting").
+  # to the cluster Alertmanager (see AGENTS.md, "Dependabot PR Alerting").
   dependabot_notify_workflow = <<-EOT
     ---
     # Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.
@@ -88,7 +91,7 @@ locals {
     jobs:
       notify:
         if: github.actor == 'dependabot[bot]'
-        uses: makeitworkcloud/shared-workflows/.github/workflows/dependabot-notify.yml@main
+        uses: makeitworkcloud/shared-workflows/.github/workflows/_dependabot-notify.yml@main
         secrets: inherit
   EOT
 }

main.tf

@@ -91,13 +91,6 @@ locals {
       value        = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"]
       repositories = local.active_github_repositories
     }
-    "grafana_alerts_token" = {
-      name = "GRAFANA_ALERTS_TOKEN"
-      # Placeholder until the operator-generated token is copied from the
-      # cluster (see AGENTS.md, "Dependabot PR Alerting").
-      value        = lookup(data.sops_file.secret_vars.data, "grafana_alerts_token", "pending-grafana-service-account-token")
-      repositories = local.active_github_repositories
-    }
     "ssh_private_key" = {
       name  = "SSH_PRIVATE_KEY"
       value = data.sops_file.secret_vars.data["ssh_private_key"]

secrets/secrets.yaml

@@ -1,7 +1,7 @@
 ssh_known_hosts: ENC[AES256_GCM,data:y20mxN9b7SCSj7hIulROnBLSexKbUU/ZNNualdPUFJt+msbCJGeQzQIpk7rVYjCWv2f9XyJJd5cToY7N53h/B6Djtr04EcS7hMaYAMbSIgKtoqWqEOhyzT9zMzzHdnevYWCFwfNg1mO1SPhgYl66ETBv+sp5OqXH3/2ISBOikN7KnruFoGYZBAhTTd0RX5/4UigkH3SbTj6H/fLYfKJr8MIuQdxfQUJyDfY3fVpHCwh4rARUlWgi4cJopjqC0UjWZ86MgByECENOt5a+7WeTl+GOdL0gpzWcztFC7Ae3x838tfQrjSaoZ1nxI4rPgyvzfy8evmV7bfXvjmrDcONxydG7gCfMCa2FBbwIYgsFR4WDnG56zcOXY1LVf7eVBXwl7GGRA3ML2+rboG2eeiuObZ5OjvlNx27PCeWTe4tB1dwOpZeJpt3AFoeF1nllSL+DreGKsGMS2pvY6dfQNZlQGu1cEqIcYA2akVbvn5k=,iv:MYug0wz3seQsEM+Jk9NQY6sEhLIDOTgqnF9h9MKSp5w=,tag:ZagIn9+s0o+nWvG/0tbjrA==,type:str]
 ssh_private_key: ENC[AES256_GCM,data:jwLxp5hbbZBeclwGLVjfIWQlRC2CGLjv8p+0buE2DqnazqobSY68wEGuvh/a+LSIgCpWLLnmBOO9H954wgzpQ2wWpH8R+oCe7OzeBvprFbvDthmQMSymW0HJ+XKwcMzkwuLtquN0oAS0GJbsfTUuqhSVrAZeNynnrUc5II8ItwZImZnlmNNCyX79QRiQ7QQlE0SSFWKSn+vyNRvw5RA0a0/FGxccyW+hFXvpuTlVr2hzxmOZiiXMBD99tRlAavT0gKCVxCEKqDcrdwkrifTZsNTxYP1NiTSMuXfsxfCoqrUMJOi/h0QGzzIpdsQnLn5908h4J8ehV/pxYlYFy5Z6hdyXk5wIu4IsegDG5lfYd+nF9p85ydGniFIK9IKTAp+J0gjN9CEEg7QfmSh/VCJ6anEKQf6HdqiQjOqeEDth8zWX/Ds8WxYpWZNX+DQqokVL2scNziesgOvx7ixHwHKx+nTcgFlDk0E/GaqWVmK4vBhdC2vWVni1IcMlxvs+NzE/drP+I9IhxR2X4r8Z/ZDXwiImfsvbE8ITSkVxyc1Yr8w+Dhq6Xx2VwL/tklU5WtX63F67Bao8F90e752l3rNyfAB/8A6oQKMY/HBKmnT9r5egDu9eE9OFoNDEqW2Zhvu+9Hc++CYJ+CrJYYaknITJP37ai/eWJkPQCTCJC4y24nETtz3j8fAaMsRrVdbeFiKxwQ0m5S+h/IEnZ9+atQqU+COqIFetDJ196ZsUhuWB4CpWzNEeloiqjSQIofnjjFgeF6L3hN1tYP+ajwar9pvnO7/boGTvGDGLaPHWzcx4wSVmqbHai3gM/UhS5mvkubcNg2S6HyIz1vOzmxbOQUDn8364NFwMPv7+rbcVYVMvcKfIrL5NDtqj6XkO3CPvGLxO/B13u4SwC16cwO1nyfG2qw4tHAhBYJLz0tyaY46L9PRLemPzQxF5+lfzlAPTMgjcTSnfnPvBu7w1vU14XWRlawOps1TatVUnO9Z0ZmyDsKq6JahpV5iuK3xXfRMTd0DQJboLVjM6TgqYvB2dIFmlFfs2QEAIgP/ZDM9ah7NiMqVol1x7c7iM1dcaekKu84fARCYU0d38IhQM3aLvVSIE49DxEfc+1S8FpWwA8otbqzUz3FrWzbIvf3Orchrgr/aeOprusRwIU4Bpc201p9MSdcAH9OeHbyQH7ICrtHObojWAQalG4SPIWMFH2BQP+t/gjTMgJTzedqjJRrw67tHQnA1f0nAKzdhsVX0cc+55/BIP7078hhuQ+2RKypKARvp+I9JKIEtj50SBHy7OWFpu9L+pRLuVTrC3tYkdsg082yP4ybtfL8c05Sh6EZb3jETlYnvyT0GZboElaYBwJgpf310Kw01KxpLw0aJVdYc5CArZPGgcVMtGX73zkzwPjjSJGBIoiKEkxGYn0OVBrx0L7NeVyYPLvxODGHvO8ZWwhcfaBqaKKO78LrzFOnmD40VRqbd/3nCUCavE6Q2QNZPhN3l/eXocUBMG60rE2cC2OP2kxpVJIqUg29jrRFRlU7/DvA2bCHtaa7yT5uWLsKjRyY0oVOOb0UerhH3rtRMOfF/29OA0YoqmrgjtRe3rF2eRP9sxKkbBaa3rWmT4whGhDU0J96H4xGD6GshNO2gbHfgOVkAUYP7UJteCqnwTdXlXhb+rAROc+P5vseNmrBKz5E5ekocPE+Fp6L7Css0TSgkgCxlZcla5gVOlOzrHaCvsXdo+LhaoDY1y8JU8KoSA/kfWMVj6LZWWevX8S/GgQybFmnRVY+HU3Gx5F4JeFYsNtuvS0JqV3xIEdnlibYNNwEQwArazUSRtY/Z+RjD2evmJKNHVj/s27mqmLTm6qsXsCgA9kVigr2Nfk2NGdF4oEPZC2d41U31F59TdDi0hzELXFXoYv3C3bEH4NNr2CySfMDki2S+C3ayRwoQxsgdN+Pb/I87ymku8oqrw8xzz6l+ykqjf4zjHFRyWwDsB01PFV6QgDDn/NW+pUUBK7/60kmTAh83Nhnotba19ydh35CaiHQjzqHAnTHSJZfzIi7Am6Ybt+HZv0bOzZ7UmQCcPSqBxmQcgx7O+o0v/hUA1yAx1j9szs604hwy7bViHH32y18sODq2Hm1EcQgwdLzRier67YS9532O5mx0NnXWQsZ2c2ujPMWyKRb3zb5KEsbCrPOJ1rWCDsflZqAzP/XULS7/Huik8ykJLUwI+2PX6vuq0T+/UGjMPR2VUAt6z5Ilv//KSehJM0VPmQ4WtQUMQg7gzo4qWYeGFIB5UfNpz0frKUZk8/NN8FFzxU1/HrcJMgGo1Tzi3TD8lw/yY5b0MuYwcGdf0K8iipJ3gjJDMHnFWDw3srWDvhlbwRhNEtZCRUUhWdvpOM7CJCgpL8TYtF4knRQdA0W2VztK4lrqmvDVyyuWOUAqFyWxca2X/9ooylWf/aRUItSpLU5OTpnT6JEC/nKganTND6p2mNdP0keBJgPM5Tbt0/Oq7itM20GRP3l1LdjuB3ED1WRwWJi0+sV6yBIMq8DbfYSzI835VDqorqVYN/Wj5zcG/clJGwXuyEC9oZgDa/QLKD66SjvjBit1fyqMkKJrtrEjDTA17UmSipGk37n1I0PSuHfBiuMcLg8OttEqa1gWasZJZCgR9nuRYkW+ph2rOK4VfgGunQo2gKqwgsaM2ksITcz95AjWuHJhcQ/YDhAdUIJmYe8aHoky+xEc3Htp3l1k6x9o+3LfEoOdJJo/WSE+/fpb/iRJhMMaQpkE4dP0NzMBcxr1Evr4HRqacaAPmidFkcjVePf3TKf0SlF4JMvjMaC9Gb2MiN9fnL9jynWpy3ubaGOgdW4E5Q5vtm0/9baIcnBv4UVdGPUWtXYZ9oWVCuOc1sG47TrphaQwFDxD60usH9TBFHkwiwpQ8Hz9h1+phdcTz1OiJXBuQ3DwXdX41C088tRGpNajK5bAY6mUvmVC+Q7yiMtXf0YDo4iRpuOJgPhqdi2Hv6hnD8AUFn7fWKunDlUpxKnfrwR9jwfiClozH4dw+xF0p4dZKr4wuKxZtgHQcuQEQMXld+MvcCiwLmnGLM0cMsZ3kcaRiBK6QrXG1IZj7MzAaC7YIFxrhpKPTD+bk0JlVW1V2omBI/imG5yWnXbCCmkDD8T2tWhy9vtNCOzh/mjE2FtVV5C3kSLbMOLpQOmX77qzi9YNZQPgtNoiyW5Pws3j9H7+PqSizxM/NvLE8aI/A20bvdO/2fcdvI/+QGwHPYZTd/E5n1GQ2xi1RB/bbfk/vFqAGNe+0Z7vQZjuL3MVekvFyfHlX3EZ+APrQ0R9Z83L1lOd5loJKuJKFZlPU/C6FFeN+Q0SZl1zlppm/+xN52KrZQa1u32DZGD4iv8084nBmBJ/scOfR8I9nqJ/sBFsPycnYqUNvNNJ9LmcNKYIA8Bk6ROvd1+Tf1wJQwFgXLg6YfDRCVlBJpSmy6lLmJ6w9pxES7n+MeGTcoHBLvy/oGpUVk85Alc4Ui4u7NEi75Gbm57zKvSzZDKQ27jCqX7KfULOxjhuF/rTLAFD9M2SgGtnCnwJZsRzLYAxXhgptYlSNdRplSGU3q2m5wXFbDvJZtrFAtyACEo/bSenQQxKSzzSCEWITEn56kVxd/gqgjo2+z9JljHSzs+JM7mRDyYD8MhemREcd6REbgbM6AH1U9fBlWTkZhVmpHSM80dGWlQ8BrUHLWlrvhghSma/NbBWAokmE/iThQCy1IwqIwtDhRdUM29hTHQzljxoiBuv1XMkE0rrKhAYTzRO/n/2bKqkIJ5Tq3DAjg2WC9t4XYSWXtSsZKyiz7XS1PzhwViJ9um/KBy2tykSJKqUShnu2Oo2bJvw3sU5vUKcedrxoFT+qbR6iFsS1K/b0u56dPikFWEoM+Kqi4h/WG2s0pKoBVZ0HKYdeju4M/Z24Sa2ue2bR8bqWCushGFEK+ZKbpJR4Z1l9e2+s2aUm2HJts40xls+3yOb8/IjvfFMBmfvv7cNJN9set1uVm+kolDtCI6oP451E+ie3DB6F0wyJhxV0BQOjzFiMusNiKR/BYqNdV0kJnNsPG+76aJkYziPfKplFA3h97XN5rAUf7zd47e5Nq2c5fkA7JODxNdWrAgMYD3tklTbp59zbwOY/eSV6ERpldBOH8/GRshPVEXZdqaIqxuQLeyceCx/YbD05nlxYhyLEu256Uc3dnaDTWBCGeNHW7hh09CD0OE63UTsoT+l4SwcB5eTi4YrQOHFy0ZNq219azkbmFyNgI88qHpw+yFyZgKaWz+BIavjOVKmygHpH/3lnQwgoOuD7IaMwyt1pkDrtkPlIooinFm4SQ5Ng+x9lD07J+jtXkHkQiMvELsUJtchgoL4FOIN/8TxfoGs3OBVe0C+IXYd/Xb49Gl6hLUtRlQDXfJKX+OA8+rImOWriXTZlZWbzYx3LQUnLOvNo2OX8s4xIHrb7h7Kef4QGOXgrP92c9F+iNdSot//sVDoCQc+PXRYa97W+,iv:EcjD0Rh76XFRumSkjAjOH4kK9gIE8xeoIk2WL2yCPyE=,tag:VbjPyVrmGBqXJPnTJzjd5Q==,type:str]
 cloudflare_auth_client_id: ENC[AES256_GCM,data:ik69sQhJwg2paYUowWq6HIHL/0OKGhICSXESNULdwrlnG4OnJ6mX,iv:bKexr9xu/zYA7nYZYx9fEQF1kMSi/vUYWbQi2UTh2dk=,tag:HWvZQagx95eI3D/83oEL3w==,type:str]
-cloudflare_auth_client_secret: ENC[AES256_GCM,data:oqD9lnwf9wSoS9IZBB0ILzZJq9sYPaOcAD+6aZSbVHuJDUnR3QZJweddWK1FxGw1u4eT7LICFL5v5mu9WEFk9Q==,iv:WjX32HfZJAD1pt5sYJmmtLPCCZ9vs3hdA4XSshXPBmg=,tag:LI5D10qlhWhn8lSQjLtTnw==,type:str]
+cloudflare_auth_client_secret: ENC[AES256_GCM,data:cYP+ZBzdTw38l3FzgP0Z2Dj8KHUlduKpGPxFLEd4Xdo94Z9AyHM+54Ho3yGBq1fZ382G5C+Ug/EBMYzZMIvNWw==,iv:EIoR7w0qS+lbuedVoj5HZMCH5g4dgFYmaNs8hHTofNM=,tag:VfPsPSo7BFHqrIkHxwo1JQ==,type:str]
 s3_bucket: ENC[AES256_GCM,data:zBVdG+sJNkgrdRw7iXh5GvliwNc=,iv:6CvZGNRKGjeC0b/Sig2eq8ROmqyHZZcqYRhVynqUG4c=,tag:N5khlbQVW87ywVNU3jMSOA==,type:str]
 s3_key: ENC[AES256_GCM,data:XqPuz071oUsHTSMgFKBqCi0=,iv:0WuTD4F7y5by9SUIjIyVIlM6mIt8OgR9WHT/v50lAqY=,tag:l1C/p4mQ7rkQhlSPnF3xYQ==,type:str]
 s3_region: ENC[AES256_GCM,data:s9mEEbAkYXUo,iv:+LGva6jpgQLOZJ7SEWB+im+pNKMnIJgzFl4fzjE5H8c=,tag:E6JVicVvHBSaFtvLZJp2tg==,type:str]
@@ -26,7 +26,7 @@ sops:
           aws_profile: ""
           created_at: "2026-06-19T04:16:52Z"
           enc: AQICAHj1IggLFhM4nJnKEvmbEpk5E9RxZZoxpZYUW0taoyrz1AF/kg94UKFDzajWL4wI8KwkAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMmVOJEF56prSE5mcxAgEQgDt27+5rh3R0yvgpohI7YEEeZqxAJQiRdIomE22ohFcv2WGRfPXvbh43PlSwUAekZwmkLMM440d0Pu8zcA==
-    lastmodified: "2026-08-24T15:30:58Z"
-    mac: ENC[AES256_GCM,data:ntytB4EW4Oo3YaKoqi0BsOy6Ij4HRE6PJ+bEKXiS3pHpIww1OVFPAYWRJPosPpkn7AYX1iSF7p+w16FJs5vKqek2hnP4wWzDzWqbbFhJAurBEjwWilLi/Phxc5SArJsWghA8UMl4g6FkRBlYC6S4pnfsmX/t0bGtIDQasVZPLU0=,iv:xTKf3t/71gvLP/ygJLbiTtOTN/9ahs55hv6wE5LYB0o=,tag:X6oDOiXdp77v3dgIQD2gVw==,type:str]
+    lastmodified: "2026-08-24T15:45:47Z"
+    mac: ENC[AES256_GCM,data:X7y3yiyl4M8UNmDQVPP6Y8djAuBnh1eK64vwR/qzlldyX1UXu1l0Q974nwZLTfH/lPsCN2KJIFQVD8y0st5SOhmnWR2nrWiw/5ktykaZ/dU7A/QFNPjHfgnvznXGySXiiuavLYtCKzhT0cpZRzQpfRO0D8fCflUj4H+nT0TDJ1M=,iv:v/953DlmuApxQEtMYU8wAokA0lq+Z2RDOZj9e1tfHc4=,tag:hmLkOgL9ecm9B9vfukk5wQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2