Secrets for pipelines, mounted as files 4ac01a732552

-- Secrets for OxygenFlow jobs (hub spec §13.2, #107), per level like

-- flow_variables. A job gets only the secrets its pipeline declares by

-- name, as files Flow mounts (OxygenFlow spec §9), never in the

-- environment. Values are sealed with keys/secrets.key.

CREATE TABLE flow_secrets (

    scope       TEXT NOT NULL CHECK (scope IN ('site', 'org', 'repo')),

    scope_id    INTEGER NOT NULL DEFAULT 0,

    name        TEXT NOT NULL,

    value       BLOB NOT NULL,

    updated_ms  INTEGER NOT NULL,

    PRIMARY KEY (scope, scope_id, name)

);

//! Secrets for OxygenFlow jobs (hub spec §13.2, oxygenhub#107): named

//! values kept per site, organisation and repository, sealed at rest

//! under `keys/secrets.key`. A job gets only the secrets its pipeline

//! declares with `secret "name" { mount-path … }`, as files Flow mounts

//! (OxygenFlow spec §9), never in the environment; the hub masks each

//! value in the job's log as it arrives. Inner levels override outer by

//! name, as variables do.

use crate::db::{now_ms, Pool};

use crate::levels::{self, Scope};

use crate::Shared;

use sqlx::FromRow;

/// How many a level may hold.

pub const MAX_PER_LEVEL: usize = 100;

/// The longest value, in bytes.

pub const MAX_VALUE: usize = 64 * 1024;

/// Values shorter than this are not masked in logs: too many false hits.

const MIN_MASKED: usize = 4;

#[derive(Clone, Debug, FromRow)]

pub struct Secret {

    pub scope: String,

    pub scope_id: i64,

    pub name: String,

    /// Sealed; `App.secret_key` opens it.

    pub value: Vec<u8>,

    pub updated_ms: i64,

}

/// A secret's name, as a pipeline names it: 1 to 64 of `A-Z a-z 0-9 . _ -`.

pub fn name_ok(name: &str) -> bool {

    !name.is_empty() && name.len() <= 64 && name.bytes().all(|b| b.is_ascii_alphanumeric() || b".-_".contains(&b))

}

pub async fn list(pool: &Pool, scope: Scope) -> sqlx::Result<Vec<Secret>> {

    sqlx::query_as("SELECT * FROM flow_secrets WHERE scope = ? AND scope_id = ? ORDER BY name")

        .bind(scope.kind())

        .bind(scope.id())

        .fetch_all(pool)

        .await

}

/// Set a secret at a level, new or changed; `sealed` is the value sealed.

pub async fn set(pool: &Pool, scope: Scope, name: &str, sealed: &[u8]) -> sqlx::Result<()> {

    sqlx::query(

        "INSERT INTO flow_secrets (scope, scope_id, name, value, updated_ms) VALUES (?, ?, ?, ?, ?) \

         ON CONFLICT (scope, scope_id, name) DO UPDATE SET value = excluded.value, updated_ms = excluded.updated_ms",

    )

    .bind(scope.kind())

    .bind(scope.id())

    .bind(name)

    .bind(sealed)

    .bind(now_ms())

    .execute(pool)

    .await?;

    Ok(())

}

/// Remove a secret from a level; false when it was not there.

pub async fn delete(pool: &Pool, scope: Scope, name: &str) -> sqlx::Result<bool> {

    let r = sqlx::query("DELETE FROM flow_secrets WHERE scope = ? AND scope_id = ? AND name = ?")

        .bind(scope.kind())

        .bind(scope.id())

        .bind(name)

        .execute(pool)

        .await?;

    Ok(r.rows_affected() == 1)

}

/// Forget a level's secrets, when the organisation or repository goes.

pub async fn delete_scope(pool: &Pool, scope: Scope) -> sqlx::Result<()> {

    sqlx::query("DELETE FROM flow_secrets WHERE scope = ? AND scope_id = ?").bind(scope.kind()).bind(scope.id()).execute(pool).await?;

    Ok(())

}

/// A secret as a level sees it: where from, and whether an inner level

/// sets the same name. The value stays sealed.

#[derive(Clone, Debug)]

pub struct Seen {

    pub secret: Secret,

    /// `the site`, `the acme organisation`, or empty for the level's own.

    pub from: String,

    pub overridden: bool,

}

/// Every secret a level sees, outermost first.

pub async fn seen(pool: &Pool, scope: Scope, owner: &str) -> sqlx::Result<Vec<Seen>> {

    let mut lvls = levels::above(pool, scope, owner).await?;

    lvls.push((scope, String::new()));

    let mut out: Vec<Seen> = vec![];

    for (level, from) in lvls {

        for s in list(pool, level).await? {

            for o in out.iter_mut().filter(|o| o.secret.name == s.name) {

                o.overridden = true;

            }

            out.push(Seen { secret: s, from: from.clone(), overridden: false });

        }

    }

    Ok(out)

}

/// The values of the named secrets as a repository's jobs get them:

/// `(name, value)` for each that is set and opens; names not set are

/// left out, as are values sealed under another key.

pub async fn for_job(app: &Shared, repo: &crate::db::repos::RepoRow, names: &[String]) -> sqlx::Result<Vec<(String, String)>> {

    let all = seen(&app.db, Scope::Repo(repo.id), &repo.owner).await?;

    let mut out = vec![];

    for name in names {

        if let Some(s) = all.iter().find(|s| !s.overridden && s.secret.name == *name) {

            if let Some(value) = app.secret_key.open(&s.secret.value) {

                out.push((name.clone(), value));

            }

        }

    }

    Ok(out)

}

/// `text` with every secret value (and its standard base64) replaced by

/// `***`, for a job's log.

pub fn mask(text: &str, values: &[String]) -> String {

    let mut out = text.to_string();

    for v in values {

        if v.len() < MIN_MASKED {

            continue;

        }

        out = out.replace(v.as_str(), "***");

        let b64 = base64_standard(v.as_bytes());

        if b64.len() >= MIN_MASKED {

            out = out.replace(&b64, "***");

        }

    }

    out

}

fn base64_standard(bytes: &[u8]) -> String {

    const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

    let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);

    for chunk in bytes.chunks(3) {

        let n = chunk.iter().fold(0u32, |acc, b| (acc << 8) | *b as u32) << (8 * (3 - chunk.len()));

        for i in 0..4 {

            if i <= chunk.len() {

                out.push(T[((n >> (18 - 6 * i)) & 63) as usize] as char);

            } else {

                out.push('=');

            }

        }

    }

    out

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn values_and_their_base64_are_masked_in_logs() {

        assert_eq!(base64_standard(b"hunter22"), "aHVudGVyMjI=");

        let line = "token=hunter22 b64=aHVudGVyMjI= short=ab done";

        assert_eq!(mask(line, &["hunter22".into(), "ab".into()]), "token=*** b64=*** short=ab done");

        assert!(name_ok("deploy-token") && name_ok("aws.key_1") && !name_ok("") && !name_ok("a b") && !name_ok(&"x".repeat(65)));

    }

}

//! The Flow secrets panel (hub spec §13.2, oxygenhub#107) shared by the

//! administration, organisation and repository settings pages: names

//! only, values typed once and never shown.

use crate::auth::Viewer;

use crate::db::accounts;

use crate::levels::At;

use crate::secrets::{self, Seen};

use crate::Shared;

use serde::Deserialize;

#[derive(Deserialize)]

pub struct SecretForm {

    #[serde(rename = "_csrf")]

    pub csrf_token: String,

    #[serde(default)]

    action: String,

    #[serde(default)]

    name: String,

    #[serde(default)]

    value: String,

}

pub struct Panel {

    pub own: Vec<Seen>,

    pub inherited: Vec<Seen>,

}

pub async fn panel(app: &Shared, at: &At) -> sqlx::Result<Panel> {

    let (own, inherited): (Vec<_>, Vec<_>) =

        secrets::seen(&app.db, at.scope, &at.owner).await?.into_iter().partition(|v| v.from.is_empty());

    Ok(Panel { own, inherited })

}

/// Apply the panel's form: `Ok(notice)` or `Err(message for the user)`.

pub async fn apply(app: &Shared, viewer: &Viewer, at: &At, f: SecretForm) -> sqlx::Result<Result<String, String>> {

    let name = f.name.trim();

    if !secrets::name_ok(name) {

        return Ok(Err("A secret's name is 1 to 64 of A-Z a-z 0-9 . _ -, as the pipeline's `secret` block names it.".into()));

    }

    Ok(Ok(match f.action.as_str() {

        "set" => {

            let value = f.value.replace("\r\n", "\n");

            if value.is_empty() {

                return Ok(Err("Type the secret's value.".into()));

            }

            if value.len() > secrets::MAX_VALUE {

                return Ok(Err(format!("A value is up to {} bytes.", secrets::MAX_VALUE)));

            }

            let own = secrets::list(&app.db, at.scope).await?;

            if own.len() >= secrets::MAX_PER_LEVEL && !own.iter().any(|s| s.name == name) {

                return Ok(Err(format!("Up to {} secrets here.", secrets::MAX_PER_LEVEL)));

            }

            secrets::set(&app.db, at.scope, name, &app.secret_key.seal(&value)).await?;

            accounts::audit(&app.db, viewer.account(), "flow.secret.set", &at.label, name).await.ok();

            format!("{name} set.")

        }

        "delete" => {

            if !secrets::delete(&app.db, at.scope, name).await? {

                return Ok(Err(format!("There is no secret {name} here.")));

            }

            accounts::audit(&app.db, viewer.account(), "flow.secret.deleted", &at.label, name).await.ok();

            format!("{name} removed.")

        }

        _ => return Ok(Err("Unknown action.".into())),

    }))

}

{% macro panel(base, s, csrf, what) %}

<section class="panel" id="secrets">

  <h2>Secrets</h2>

  <p class="small mute">{{ what }} A job gets only the secrets its pipeline declares, as <code>secret "name" { mount-path "/run/secrets/name" }</code>, written there as a file before it starts; never in the environment, and masked in its log. Values are kept sealed and never shown again.</p>

  {% if !s.inherited.is_empty() %}

  <h3>Inherited</h3>

  <div class="table"><table>

  <tr><th>Name</th><th>Set</th><th>From</th></tr>

  {% for i in s.inherited %}<tr{% if i.overridden %} class="mute"{% endif %}><td><code>{{ i.secret.name }}</code></td><td class="small">{{ i.secret.updated_ms|ago_i }}</td><td class="small">{{ i.from }}{% if i.overridden %} · <span title="A level below sets the same name">overridden</span>{% endif %}</td></tr>{% endfor %}

  </table></div>

  {% endif %}

  {% if s.own.is_empty() %}<p class="mute small">{% if s.inherited.is_empty() %}None.{% else %}None of its own.{% endif %}</p>{% else %}

  <div class="table"><table>

  <tr><th>Name</th><th>Set</th><th></th></tr>

  {% for o in s.own %}<tr><td><code>{{ o.secret.name }}</code></td><td class="small">{{ o.secret.updated_ms|ago_i }}</td>

  <td><form class="tiny" method="post" action="{{ base }}/secrets"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="name" value="{{ o.secret.name }}"><button name="action" value="delete" class="danger-btn">remove</button></form></td></tr>{% endfor %}

  </table></div>{% endif %}

  <form class="card" method="post" action="{{ base }}/secrets">

    <input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="action" value="set">

    <h3>Set a secret</h3>

    <label for="sname">Name</label><input type="text" id="sname" name="name" placeholder="deploy-token" required autocomplete="off">

    <label for="svalue">Value</label><textarea id="svalue" name="value" rows="2" autocomplete="off"></textarea>

    <p class="small mute">An existing name takes the new value; a name set above is overridden here.</p>

    <button type="submit">SET</button>

  </form>

</section>

{% endmacro %}

- **Secrets for pipelines (#107).** Administration, organisation and repository settings hold secrets, typed once and sealed; a job gets only those its pipeline declares with `secret`, as files Flow mounts before it starts, never in the environment; their values are masked in the job's log as it arrives.

        SecretKey::load_or_create_named(keys, "assistants.key")

    }

    /// The same, for another key file beside it (`secrets.key` seals Flow

    /// secrets, #107).

    pub fn load_or_create_named(keys: &Path, file: &str) -> anyhow::Result<SecretKey> {

        let path = keys.join(file);

        secrets: vec![],

    let (inputs, ids, mut left_out) = subrepo_inputs(&app, &row, &run).await;

    // The secrets the job declares, as files (#107); one not set is said

    // at the top of the log and left out, so the job fails on the file.

    let names: Vec<String> = claim.job.secrets.iter().map(|s| s.name.clone()).collect();

    let found = crate::secrets::for_job(&app, &row, &names).await?;

    for s in &claim.job.secrets {

        match found.iter().find(|(n, _)| *n == s.name) {

            Some((name, value)) => {

                claim.secrets.push(flow_core::api::SecretInput { name: name.clone(), path: s.mount_path.clone(), value: value.clone() })

            }

            None => left_out.push(format!(

                "secret {:?} is not set for this repository, its owner or the site; {} will be missing",

                s.name, s.mount_path

            )),

        }

    }

    // A secret's value never reaches the stored log (#107).

    let values: Vec<String> = match serde_json::from_str::<flow_core::Job>(&job.spec) {

        Ok(spec) if !spec.secrets.is_empty() => {

            let run = fdb::run_by_id(&app.db, job.run_id).await?;

            let row = match run {

                Some(run) => db::repos::get_by_id(&app.db, run.repo_id).await?,

                None => None,

            };

            match row {

                Some(row) => {

                    let names: Vec<String> = spec.secrets.iter().map(|s| s.name.clone()).collect();

                    crate::secrets::for_job(&app, &row, &names).await?.into_iter().map(|(_, v)| v).collect()

                }

                None => vec![],

            }

        }

        _ => vec![],

    };

        if !values.is_empty() {

            r.text = crate::secrets::mask(&r.text, &values);

        }

pub mod secrets;

    /// Seals Flow secrets at rest (hub spec §13.2, #107).

    pub secret_key: assistants::SecretKey,

    let secret_key = assistants::SecretKey::load_or_create_named(&config.keys_dir(), "secrets.key")?;

        secret_key,

    /// The site's Flow secrets (#107).

    secrets: super::secrets::Panel,

    let secrets = super::secrets::panel(app, &site_assistants()).await.map_err(e)?;

        secrets,

/// `POST /admin/secrets`: the site's Flow secrets (#107).

pub async fn secrets(

    State(app): State<Shared>,

    viewer: Viewer,

    Form(f): Form<super::secrets::SecretForm>,

) -> Result<Page<AdminPage>, Error> {

    let shell = Shell::new(&app, "/admin", &viewer);

    require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let outcome = super::secrets::apply(&app, &viewer, &site_assistants(), f).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    admin_page(&app, shell, Some(outcome.unwrap_or_else(|e| e))).await

}

mod secrets;

        .route("/orgs/{name}/settings/secrets", post(orgs::secrets))

        .route("/admin/secrets", post(admin::secrets))

        .route("/{owner}/{name}/settings/secrets", post(repo_settings::secrets))

use super::{filters, Error, Page, Shell};

    /// The organisation's Flow secrets (#107).

    secrets: super::secrets::Panel,

    let secrets = super::secrets::panel(app, &org_assistants(&org)).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    Ok(Page(OrgSettingsPage {

        shell,

        org,

        members,

        teams,

        hooks,

        notice,

        error,

        runners,

        runner_token: None,

        assistants,

        variables,

        secrets,

    }))

/// `POST /orgs/{name}/settings/secrets`: the organisation's Flow secrets (#107).

pub async fn secrets(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(name): Path<String>,

    Form(f): Form<super::secrets::SecretForm>,

) -> Result<Page<OrgSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/orgs/{name}/settings"), &viewer);

    let (_, org) = owned_org(&app, &shell, &viewer, &name).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    match super::secrets::apply(&app, &viewer, &org_assistants(&org), f).await.map_err(|e| Error::from_db(shell.clone(), e))? {

        Ok(notice) => org_page(&app, shell, org, Some(notice), None).await,

        Err(error) => org_page(&app, shell, org, None, Some(error)).await,

    }

}

    /// The repository's Flow secrets (#107).

    secrets: super::secrets::Panel,

    let secrets = super::secrets::panel(app, &repo_assistants(&row)).await.map_err(|e| Error::from_db(shell.clone(), e))?;

        secrets,

    crate::secrets::delete_scope(&app.db, crate::levels::Scope::Repo(row.id)).await.ok();

/// `POST /{owner}/{name}/settings/secrets`: the repository's Flow secrets

/// (#107), for its admins.

pub async fn secrets(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

    Form(f): Form<super::secrets::SecretForm>,

) -> Result<Page<RepoSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/settings"), &viewer);

    let (_, row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Admin).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    match super::secrets::apply(&app, &viewer, &repo_assistants(&row), f).await.map_err(|e| Error::from_db(shell.clone(), e))? {

        Ok(notice) => settings_page(&app, shell, row, role, Some(notice), None).await,

        Err(error) => settings_page(&app, shell, row, role, None, Some(error)).await,

    }

}

#[tokio::test(flavor = "multi_thread")]

async fn secrets_a_job_declares_come_with_the_claim_and_never_reach_the_log() {

    let h = hub().await;

    let app = &h.app;

    let res = oxygenhub::router(app.clone())

        .oneshot(

            Request::post("/register")

                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")

                .body(Body::from("username=andy&email=a%40example.com&password=correct-horse-battery"))

                .unwrap(),

        )

        .await

        .unwrap();

    let cookie = res.headers().get(header::SET_COOKIE).unwrap().to_str().unwrap().split(';').next().unwrap().to_string();

    let page = |path: &str, form: Option<String>| {

        let mut req =

            Request::builder().method(if form.is_some() { "POST" } else { "GET" }).uri(path).header(header::COOKIE, cookie.clone());

        if form.is_some() {

            req = req.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded");

        }

        let req = req.body(Body::from(form.unwrap_or_default())).unwrap();

        let app = app.clone();

        async move {

            let res = oxygenhub::router(app).oneshot(req).await.unwrap();

            let status = res.status();

            let body = String::from_utf8(res.into_body().collect().await.unwrap().to_bytes().to_vec()).unwrap();

            (status, body)

        }

    };

    let csrf_of = |page: &str| {

        let i = page.find("name=\"_csrf\" value=\"").expect("csrf field") + "name=\"_csrf\" value=\"".len();

        page[i..].split('"').next().unwrap().to_string()

    };

    create(app, "andy", "demo").await;

    // The site sets deploy-token; the repository overrides it. Neither

    // page shows a value, only that it is set.

    let (_, admin) = page("/admin", None).await;

    let csrf = csrf_of(&admin);

    let (_, body) = page("/admin/secrets", Some(format!("_csrf={csrf}&action=set&name=deploy-token&value=site-level-value"))).await;

    assert!(body.contains("deploy-token set.") && !body.contains("site-level-value"), "{body}");

    let (_, body) = page("/admin/secrets", Some(format!("_csrf={csrf}&action=set&name=bad+name&value=x"))).await;

    assert!(body.contains("name is 1 to 64 of"), "{body}");

    let (_, settings) = page("/andy/demo/settings", None).await;

    assert!(

        settings.contains("Secrets") && settings.contains("<code>deploy-token</code>") && settings.contains("the site</td>"),

        "{settings}"

    );

    let csrf_r = csrf_of(&settings);

    let (_, body) =

        page("/andy/demo/settings/secrets", Some(format!("_csrf={csrf_r}&action=set&name=deploy-token&value=hunter22-repo-value"))).await;

    assert!(body.contains("deploy-token set.") && body.contains("overridden") && !body.contains("hunter22"), "{body}");

    let repo = db::repos::get(&app.db, "andy", "demo").await.unwrap().unwrap();

    assert!(

        !String::from_utf8_lossy(&oxygenhub::secrets::list(&app.db, oxygenhub::levels::Scope::Repo(repo.id)).await.unwrap()[0].value)

            .contains("hunter22"),

        "sealed at rest"

    );

    // A job that declares the secret, and one the levels do not hold.

    let url = format!("{}/andy/demo", h.base);

    let work = tempfile::tempdir().unwrap();

    let c = client(&url, work.path());

    write(

        work.path(),

        ".flow/pipeline.kdl",

        &pipeline("job \"deploy\" {\n    sandbox \"alpine\"\n    secret \"deploy-token\" {\n        mount-path \"/run/secrets/token\"\n    }\n    secret \"missing\" {\n        mount-path \"/run/secrets/missing\"\n    }\n    exec \"deploy\"\n}\n"),

    );

    write(work.path(), "test.sh", "echo ok\n");

    c.snapshot("test").unwrap();

    c.commit("Add a pipeline", &[]).unwrap();

    assert!(c.push("origin", false).unwrap().iter().all(|r| r.ok));

    let runs = runs_of(app, "andy", "demo").await;

    let jobs = match runs.first() {

        Some(r) => db::flow::jobs(&app.db, r.id).await.unwrap().iter().map(|j| format!("{}:{}", j.name, j.status)).collect::<Vec<_>>(),

        None => vec![],

    };

    let mut deploy = None;

    for _ in 0..50 {

        let Some(got) = claim(app).await else {

            tokio::time::sleep(std::time::Duration::from_millis(100)).await;

            continue;

        };

        if got["job"]["name"] == "deploy" {

            deploy = Some(got);

            break;

        }

        assert_eq!(got["secrets"], serde_json::Value::Null, "{got}");

    }

    let got = deploy.unwrap_or_else(|| panic!("the deploy job: runs {runs:?} jobs {jobs:?}"));

    assert_eq!(

        got["secrets"],

        serde_json::json!([{ "name": "deploy-token", "path": "/run/secrets/token", "value": "hunter22-repo-value" }]),

        "the repository's value, the missing one left out: {got}"

    );

    let id = got["job_id"].as_i64().unwrap();

    let log = db::flow::log(&app.db, id, 0, 100).await.unwrap();

    assert!(log.iter().any(|l| l.stream == "flow" && l.text.contains("secret \"missing\" is not set")), "{log:?}");

    // The value never reaches the stored log, plain or base64.

    let records = serde_json::json!({ "records": [

        { "t": 1, "stream": "out", "text": "token=hunter22-repo-value" },

        { "t": 2, "stream": "err", "text": "b64 aHVudGVyMjItcmVwby12YWx1ZQ== end" },

    ] });

    let (st, _) = call(app, "POST", &format!("/api/v1/flow/jobs/{id}/log"), Some("runner-secret"), Some(records.to_string())).await;

    assert_eq!(st, StatusCode::NO_CONTENT);

    let log = db::flow::log(&app.db, id, 0, 100).await.unwrap();

    let texts: Vec<&str> = log.iter().map(|l| l.text.as_str()).collect();

    assert!(texts.contains(&"token=***") && texts.contains(&"b64 *** end"), "{texts:?}");

    assert!(!texts.iter().any(|t| t.contains("hunter22")), "{texts:?}");

}

- **Secrets** (oxygenhub#107; OxygenFlow spec §9): the same three levels hold **Secrets**, named as a pipeline's `secret "name" { mount-path "/run/secrets/…" }` names them (1 to 64 of `A-Z a-z 0-9 . _ -`, a value up to 64 KiB, up to 100 per level), typed once and sealed under `keys/secrets.key`; pages show names, when each was set and where it comes from, never a value. A claim carries only the secrets its job declares, each with its path and value, from the innermost level that sets the name; one no level sets is noted at the top of the job's log and left out, so the job fails on the missing file rather than running with a stand-in. Flow writes each as a file (0400, the job's user's, on an in-memory mount) before the job starts and never puts it in the environment, the receipt or an artifact. Log intake replaces each value, and its base64, with `***` before a record is stored. Changes are audited (`flow.secret.set`, `flow.secret.deleted`), never with the value.

{% import "secrets_panel.html" as se %}

{% call se::panel("/admin", secrets, shell.csrf, "Every repository's jobs may use these, unless an organisation or repository sets the same name.") %}

{% import "secrets_panel.html" as se %}

  <a href="#secrets">Secrets</a>

{% call se::panel("/orgs/" ~ org.name ~ "/settings", secrets, shell.csrf, "Jobs of every repository of the organisation may use these, beside the site's and each repository's own.") %}

{% import "secrets_panel.html" as se %}

  <a href="#secrets">Secrets</a>

{% call se::panel(repo.url ~ "/settings", secrets, shell.csrf, "This repository's jobs may use these, beside the ones the site and its owner set.") %}