dev.knotless.putSecret

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Leaves a secret for a repository with one of its runners, sealed to the runner's dev.knotless.runnerKey so the appview holds only ciphertext. The caller is the repository's owner, or an admin who joined the organization that owns it. One there already under the same repository, runner and name is replaced. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.",
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "key": {
              "description": "The runner's key it is sealed to, a did:key.",
              "format": "did",
              "type": "string"
            },
            "name": {
              "description": "The secret's name, as a workflow's `secrets` lists it: a shell variable's name, not one starting KNOTLESS_RUN.",
              "maxLength": 64,
              "type": "string"
            },
            "owner": {
              "description": "The repository's owner; absent, the caller. Another account only when the caller is an admin who joined it as an organization.",
              "format": "did",
              "type": "string"
            },
            "refs": {
              "description": "The refs whose pushes it reaches, as a trigger's `refs` match them; absent for every push.",
              "items": {
                "ref": "dev.knotless.listSecrets#refPattern",
                "type": "ref"
              },
              "maxLength": 16,
              "type": "array"
            },
            "repo": {
              "description": "The repository's key, as its dev.knotless.repo record holds it: a rename keeps it.",
              "maxLength": 32,
              "type": "string"
            },
            "runner": {
              "description": "The runner it is sealed to.",
              "format": "did",
              "type": "string"
            },
            "sealed": {
              "description": "The value sealed with HPKE to `key`, bound to `owner`, `repo`, `runner`, `name` and `refs`: the encapsulated key, then the ciphertext.",
              "maxLength": 16465,
              "type": "bytes"
            }
          },
          "required": [
            "repo",
            "runner",
            "name",
            "key",
            "sealed"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {},
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "dev.knotless.putSecret",
  "lexicon": 1
}