From
bafyreigrlw34dlhemri3euc2xxyyyqnk3rbantcff5qkqy4morsrctatke
indexed 2026-10-30 05:19 UTC
View this version
To
bafyreia5oq2vtdrapl4fq37o3pwh6xcnl5y5slfmyeva4oclyeoz45itjq
indexed 2026-11-02 20:49 UTC
View this version
Compatibility
backward compatible Backward compatible. 2 non-breaking changes.
Non-breaking changes (2)
- AddedVertex AddedVertex { vertex_id: "dev.knotless.putSecret:input.owner" }
- AddedEdge AddedEdge { src: "dev.knotless.putSecret:input", tgt: "dev.knotless.putSecret:input.owner", kind: "prop", name: Some("owner") }
Migration guidance
Added
AddedVertex { vertex_id: "dev.knotless.putSecret:input.owner" }
Notes
- Non-breaking: AddedEdge { src: "dev.knotless.putSecret:input", tgt: "dev.knotless.putSecret:input.owner", kind: "prop", name: Some("owner") }
Changes
11
{22
"$type": "com.atproto.lexicon.schema",33
"defs": {44
"main": {5
"description": "Leaves a secret for one of the caller's repositories with one of its runners, sealed to the runner's dev.knotless.runnerKey so the appview holds only ciphertext. The caller is the repository's owner. One there already under the same repository, runner and name is replaced. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.",5
"description": "Leaves a secret for a repository with one of its runners, sealed to the runner's dev.knotless.runnerKey so the appview holds only ciphertext. The caller is the repository's owner, or an admin who joined the organization that owns it. One there already under the same repository, runner and name is replaced. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.",66
"input": {77
"encoding": "application/json",88
"schema": {99
"properties": {1010
"key": {1111
"description": "The runner's key it is sealed to, a did:key.",1212
"format": "did",1313
"type": "string"1414
},1515
"name": {1616
"description": "The secret's name, as a workflow's `secrets` lists it: a shell variable's name, not one starting KNOTLESS_RUN.",1717
"maxLength": 64,1818
"type": "string"1919
},20
"owner": {21
"description": "The repository's owner; absent, the caller. Another account only when the caller is an admin who joined it as an organization.",22
"format": "did",23
"type": "string"24
},2025
"refs": {2126
"description": "The refs whose pushes it reaches, as a trigger's `refs` match them; absent for every push.",2227
"items": {2328
"ref": "dev.knotless.listSecrets#refPattern",2429
"type": "ref"2530
},2631
"maxLength": 16,2732
"type": "array"2833
},2934
"repo": {3035
"description": "The repository's key, as its dev.knotless.repo record holds it: a rename keeps it.",3136
"maxLength": 32,3237
"type": "string"3338
},3439
"runner": {3540
"description": "The runner it is sealed to.",3641
"format": "did",3742
"type": "string"3843
},3944
"sealed": {40
"description": "The value sealed with HPKE to `key`, bound to the caller, `repo`, `runner`, `name` and `refs`: the encapsulated key, then the ciphertext.",45
"description": "The value sealed with HPKE to `key`, bound to `owner`, `repo`, `runner`, `name` and `refs`: the encapsulated key, then the ciphertext.",4146
"maxLength": 16465,4247
"type": "bytes"4348
}4449
},4550
"required": [4651
"repo",4752
"runner",4853
"name",4954
"key",5055
"sealed"5156
],5257
"type": "object"5358
}5459
},5560
"output": {5661
"encoding": "application/json",5762
"schema": {5863
"properties": {},5964
"type": "object"6065
}6166
},6267
"type": "procedure"6368
}6469
},6570
"id": "dev.knotless.putSecret",6671
"lexicon": 16772
}