Lexicon Garden

dev.knotless.putSecret

Leaves a secret for a repository with one of its runners, sealed to the runner's dev.knotless.runnerKey so the appview holds only ciphertext. The caller is the repository's owner, or an admin who joined the organization that owns it. One there already under the same repository, runner and name is replaced. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.

Repository @lexicons.knotless.dev did:plc:yqsg7znbbhfmj3a2nrpnaerk namespace authority
Details · procedure
Kindprocedure
Authorityknotless.dev
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

key

requiredstring · did

The runner's key it is sealed to, a did:key.

name

requiredstring

The secret's name, as a workflow's `secrets` lists it: a shell variable's name, not one starting KNOTLESS_RUN.

  • maxLength: 64

owner

string · did

The repository's owner; absent, the caller. Another account only when the caller is an admin who joined it as an organization.

refs

array

The refs whose pushes it reaches, as a trigger's `refs` match them; absent for every push.

  • maxLength: 16

repo

requiredstring

The repository's key, as its dev.knotless.repo record holds it: a rename keeps it.

  • maxLength: 32

runner

requiredstring · did

The runner it is sealed to.

sealed

requiredbytes

The value sealed with HPKE to `key`, bound to `owner`, `repo`, `runner`, `name` and `refs`: the encapsulated key, then the ciphertext.

  • maxLength: 16465

Output

application/json

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • dev.knotless.listSecrets

    query

    The secrets dev.knotless.putSecret left for a repository, by name. Its owner, and an admin who joined the organization that owns it, sees every one, with the value only of those sealed to it, as a runner that logs in as the owner or that admin. A runner sees those sealed to it, with the sealed value, to open with its key; anyone else, none. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.

  • dev.knotless.deleteSecret

    procedure

    Deletes the secrets dev.knotless.putSecret left for a repository the caller owns, or administers as an organization's admin who joined: those of a name, those sealed to a runner, or both; with neither, all of the repository's. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.

  • org.tangled.secret.addSecret

    procedure

    Add a CI secret

  • dev.knotless.runnerKey

    record

    The key a knotless runner opens the secrets owners give it with.