Secrets for pipelines, mounted as files (OxygenFlow spec §9) issue #107
closed: completed andymccall opened this · 0 comments
andymccall
Follow-up to issue #102 (variables). Variables are plain and shown in full; secrets need the path OxygenFlow's spec §9 sets out: never in the environment, but mounted read-only (0400, in-memory) into the sandbox where the pipeline declares secret "name" { mount-path "/run/secrets/name" }.
Hub side:
A Secrets panel beside Variables at the site, an organisation and a repository: name, value typed once, kept sealed (as assistants' tokens are, under keys/), shown as set or none, inner levels overriding outer by name.
A claim carries only the secrets a job declares by name, as secrets: [{name, mount_path, value}], and only to a runner in the repository's scope.
Log intake masks each secret's value (and its base64) in the job's records before they are stored.
Audit entries for set and removed; never the value.
Runner side (oxygenflow): the pipeline's secret block (refused in M0 today), the claim's secrets, flow-init writing each to its mount path on a tmpfs before exec, and the file never reaching the receipt or an artifact. The same file channel serves OIDC job tokens (issue #103).
Follow-up to issue #102 (variables). Variables are plain and shown in full; secrets need the path OxygenFlow's spec §9 sets out: never in the environment, but mounted read-only (0400, in-memory) into the sandbox where the pipeline declares
secret "name" { mount-path "/run/secrets/name" }.Hub side:
secrets: [{name, mount_path, value}], and only to a runner in the repository's scope.Runner side (oxygenflow): the pipeline's
secretblock (refused in M0 today), the claim'ssecrets, flow-init writing each to its mount path on a tmpfs before exec, and the file never reaching the receipt or an artifact. The same file channel serves OIDC job tokens (issue #103).