Add safe repository password rotation

internal/secrets/store.go

@@ -75,7 +75,28 @@ func (s *Store) Put(id, kind, plaintext string) error {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(filepath.Join(s.dir, id+".json"), append(b, '\n'), 0600)
+	tmp, err := os.CreateTemp(s.dir, ".secret-*")
+	if err != nil {
+		return err
+	}
+	tmpPath := tmp.Name()
+	defer os.Remove(tmpPath)
+	if err := tmp.Chmod(0600); err != nil {
+		tmp.Close()
+		return err
+	}
+	if _, err := tmp.Write(append(b, '\n')); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Sync(); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmpPath, filepath.Join(s.dir, id+".json"))
 }
 
 func (s *Store) Get(id string) (string, error) {