vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Let a job declare the secrets it reads

4ac42680eca3181efc70099f65d6e2c9f45e9dd2 · Keenan Nemetz · 7d ago · parent 0c40a1d3

Let a job declare the secrets it reads

A job now names the repository secrets it needs, and the instance delivers
those values when the job is leased. The workflow carries names only, so the
queue row, the metadata branch and the run record never hold a value: the
record names the version of each value the job ran with, which is what makes a
result say which one it used.

    jobs:
      deploy:
        image: alpine:3.22
        secrets: [DEPLOY_KEY]

A name the repository has no value for is not a failure. The variable is left
unset rather than empty, the step's shell can tell the difference, and the
runner writes one line to the log saying which value was missing. That keeps
an optional secret optional and leaves "required" with the step, where someone
can write the message: ${DEPLOY_KEY:?DEPLOY_KEY is not set}.

The value reaches the step through a file the runner writes into the run
directory it already mounts at /run/vole for an event payload, and each step is
prefixed with `. /run/vole/secrets.env`. That is deliberately not an env-file
argument to the runtime, which cannot carry a line break, and not --env, which
puts the value in the process's argument list where every process on the host
can read it. A local `vole workflow run` writes the same file, reading the
values with the developer's own credential, and says which ones it could not
read.

The name rule and the 128 KiB limit moved to ci, next to the environment rules
they mirror, so the store refuses a name no workflow could declare and the
workflow refuses a name no process environment could carry.

Slice 2 of #154.

ci/agent/validate_test.go +53

@@ -99,3 +99,56 @@ func TestJobWithTooManyStepsIsRefused(t *testing.T) {
	99	99	t.Fatal("a job with too many steps was accepted")
	100	100	}
	101	101	}
		102
		103	func TestLeasedSecretsAreRevalidated(t *testing.T) {
		104	t.Parallel()
		105	cases := []struct {
		106	name string
		107	mutate func(*runnerJob)
		108	want string
		109	}{
		110	{"not a name", func(j *runnerJob) {
		111	j.Secrets = map[string]runnerSecret{"lower": {Version: 1, Value: "x"}}
		112	}, "not a secret name"},
		113	{"would replace a runner variable", func(j *runnerJob) {
		114	j.Secrets = map[string]runnerSecret{"HOME": {Version: 1, Value: "/tmp"}}
		115	}, "variable the runner sets"},
		116	{"no version", func(j *runnerJob) {
		117	j.Secrets = map[string]runnerSecret{"KEY": {Value: "x"}}
		118	}, "no version"},
		119	{"nul byte", func(j *runnerJob) {
		120	j.Secrets = map[string]runnerSecret{"KEY": {Version: 1, Value: "a\x00b"}}
		121	}, "NUL"},
		122	{"larger than one variable", func(j *runnerJob) {
		123	j.Secrets = map[string]runnerSecret{"KEY": {Version: 1, Value: strings.Repeat("x", ci.MaxSecretBytes)}}
		124	}, "larger than one environment variable"},
		125	{"missing name is not a name", func(j *runnerJob) {
		126	j.Missing = []runnerSecretIssue{{Name: "not a name"}}
		127	}, "the runner can report"},
		128	{"missing reason is two lines", func(j *runnerJob) {
		129	j.Missing = []runnerSecretIssue{{Name: "KEY", Reason: "one\ntwo"}}
		130	}, "the runner can report"},
		131	}
		132	for _, c := range cases {
		133	t.Run(c.name, func(t *testing.T) {
		134	t.Parallel()
		135	job := goodJob(t)
		136	c.mutate(job)
		137	err := validateJob(job)
		138	if err == nil {
		139	t.Fatal("the job was accepted")
		140	}
		141	if !strings.Contains(err.Error(), c.want) {
		142	t.Fatalf("error = %v; want one mentioning %q", err, c.want)
		143	}
		144	})
		145	}
		146
		147	// A delivered value and a missing name are both normal.
		148	job := goodJob(t)
		149	job.Secrets = map[string]runnerSecret{"DEPLOY_KEY": {Version: 2, Value: "s3cret"}}
		150	job.Missing = []runnerSecretIssue{{Name: "NOT_SET"}}
		151	if err := validateJob(job); err != nil {
		152	t.Fatalf("a valid job with secrets was refused: %v", err)
		153	}
		154	}