Runbook: Secrets

[confused-Techie]

As suggested on Discord we really ought to start documenting all the knowledge that currently only exists in people's head.

Seems best to do this via some simple runbooks, with my first entry being that about secrets.

This initial guide focusing on what secrets we use, where they are, who owns them, and what to do when updating them.

Please feel free to provide any feedback possible, as this is a first of this format.

---

As they requested this initially @savetheclocktower

[savetheclocktower]

All in all, this looks great. I started to leave some suggestions (feel free to take or leave any of them) but just having this stuff written down is great and I'm not going to stress out about formatting or structure. Thanks!

[DeeDeeG]

I reckon the "Last Updated" info, while helpful now, may soon be outdated. I don't expect to impose on those who update PATs or credentials regularly that they also swing around and update this document, so I propose to delete the "Last updated" lines.

(I reckon those of us preparing or reviewing this PR know the dates written there now, and that by the time they would be out of date, they might only serve to confuse or misdirect others not present at this PR.)

Also proposed some diffs to add what I know about the tokens I've been presiding over for Cirrus.

[confused-Techie]

@savetheclocktower Thanks a ton for your feedback, I'll address some of the changes suggested of data before getting to those formatting changes, but they do look like good calls.

And to @DeeDeeG the Last Updated datapoint is less meant to indicate when the secret itself was last updated, but when the ownership of said secret was last updated in this document. With the idea that if someone reviews this document a year from now and realize they now have ownership of something or that someone else days they could update the ownership datapoint along with when they are updating it.
But seeing as how you found it confusing I'll be sure to change it.
Do you think this is still valuable data? By maybe changing the wording to say "Accurate as of" instead of "Last Updated"? Or do you think it's best to remove it all together like you suggested?

[confused-Techie]

I've now addressed all feedback provided if anyone would like to re-review so we can get this merged, I'd appreciate it!
@DeeDeeG @savetheclocktower

[confused-Techie]

Actually, @savetheclocktower has already provided an approval. Considering that everyone's concerns have been handled, and the propensity of PR's in this repository to hang in limbo, I'm gonna go ahead and run with that original approval and merge this one.

Thanks for everyone that took a look at this, appreciate it!

[savetheclocktower]

I should've asked this before this landed, but: how is membership in the NPM organization decided? Do we have a bus factor there as well?

[confused-Techie]

Not as much of one, users have to be added to the NPM organization.

But that's actually perfect subject matter for #319 and I can go ahead and add it there. Thanks for pointing it out