The FIGMA_TOKEN repo secret (created 2026-07-22, 90-day expiry) expires on
2026-10-20. Rotate it on or before 2026-10-13 — a week ahead.
Why this needs a reminder
When it lapses the failure is easy to misread: everything else in
design-parity.yml keeps working, and only the figma-sourced entries in
design-map.json fail to resolve. The claude-design entries still render from
their committed HTML, so the run looks mostly healthy.
Currently affected entries (see design-map.json):
ChatBodyPreviews.kt#ContactChatPreviewChatBodyPreviews.kt#ChannelChatPreviewChatBodyPreviews.kt#CommandsPreviewDeviceSettingsBodyPreviews.kt#DeviceSettingsPreview- (plus
CachedDeviceBodyPreview, once its node id lands)
How to rotate
- https://www.figma.com/settings -> Security -> Personal access tokens ->
Generate new token.
- Scope:
file_content:read only. That one scope covers both calls
@design-parity/adapter-figma makes -- GET /v1/files/:key/nodes and
GET /v1/images. file_metadata:read is optional and only makes failures
more legible.
- Do not add write scopes. A Figma PAT is scoped to the whole account,
not to one file, so it already inherits access to every file the owner can
see; write scopes would let a headless job mutate the design source it is
supposed to be judged against.
file_variables:read will not be offered -- the Variables REST API is
Enterprise-only and this is a Pro team. That is expected and harmless: the
adapter degrades to structure-only tokens, and spec tokens come from each
entry's tokensFile (design/meshcore.tokens.json), not from Figma.
- Set a fresh expiry (90 days) rather than "no expiration".
- Update the secret:
https://github.com/yschimke/meshcore-mobile/settings/secrets/actions
- Re-run the Design parity artifacts workflow and confirm the
figma:
entries resolve.
- Open the next rotation reminder issue with the new date.
Verify it worked
curl -H "X-Figma-Token: $FIGMA_TOKEN" \
"https://api.figma.com/v1/files/gYzowY4cQ7rNr2gYoco1M6/nodes?ids=73:5" | head -c 200
A 403 means the token is wrong or unscoped; a JSON body with a nodes key
means it works.
Context: docs/design-parity.md, "The Figma file (design-led references)".
The
FIGMA_TOKENrepo secret (created 2026-07-22, 90-day expiry) expires on2026-10-20. Rotate it on or before 2026-10-13 — a week ahead.
Why this needs a reminder
When it lapses the failure is easy to misread: everything else in
design-parity.ymlkeeps working, and only thefigma-sourced entries indesign-map.jsonfail to resolve. Theclaude-designentries still render fromtheir committed HTML, so the run looks mostly healthy.
Currently affected entries (see
design-map.json):ChatBodyPreviews.kt#ContactChatPreviewChatBodyPreviews.kt#ChannelChatPreviewChatBodyPreviews.kt#CommandsPreviewDeviceSettingsBodyPreviews.kt#DeviceSettingsPreviewCachedDeviceBodyPreview, once its node id lands)How to rotate
Generate new token.
file_content:readonly. That one scope covers both calls@design-parity/adapter-figmamakes --GET /v1/files/:key/nodesandGET /v1/images.file_metadata:readis optional and only makes failuresmore legible.
not to one file, so it already inherits access to every file the owner can
see; write scopes would let a headless job mutate the design source it is
supposed to be judged against.
file_variables:readwill not be offered -- the Variables REST API isEnterprise-only and this is a Pro team. That is expected and harmless: the
adapter degrades to structure-only tokens, and spec tokens come from each
entry's
tokensFile(design/meshcore.tokens.json), not from Figma.https://github.com/yschimke/meshcore-mobile/settings/secrets/actions
figma:entries resolve.
Verify it worked
A
403means the token is wrong or unscoped; a JSON body with anodeskeymeans it works.
Context: docs/design-parity.md, "The Figma file (design-led references)".