Secrets and a job identity issue #27 closed: completed andymccall opened this · 1 comment
andymccall set labels flow-next, feature ·
andymccall
Done: secrets as files scoped to a repository and handed to a job by name, never logged (oxygenhub #107), and a short-lived OIDC job identity issued per job (oxygenhub #103), alongside the per-job token limited to the run's repository. Closing.
andymccall closed ·
A job cannot publish anything: no secrets, no token. Add secrets scoped to a repository (and to a bookmark or tag pattern), handed to a job only by name in its pipeline and never logged, and a short-lived job token the hub issues per job (like GitHub's OIDC token) that the publish step uses, limited to the run's repository.