Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Merge brokered secrets: a secret a job uses only to call an API can be tied to the hosts it is for, and the job gets a stand-in in its place, which g1t fills in on the way out to those hosts and nowhere else, so the value never enters the sandbox; and a request to an allowed host that fails upstream is retried when it can be, or answered with a 502 that says why, rather than reset. | 1 | -- Brokered secrets. A secret row with hosts is brokered: a workflow job is |
| 2 | -- given a stand-in for it in place of its value, and the runner Worker puts | |
| 3 | -- the value on the job's requests to those hosts as they leave its sandbox. | |
| 4 | -- The hosts are a JSON array of domains (`api.example.com`, | |
| 5 | -- `*.example.com`); null for a secret that is not brokered. | |
| 6 | ALTER TABLE settings ADD COLUMN brokered_hosts TEXT; | |
| 7 | ||
| 8 | -- The stand-ins jobs were given: each a random token unique to one job and | |
| 9 | -- one secret, its value sealed and bound to the stand-in, the hosts it is | |
| 10 | -- filled in for, and when it stops working (the job's time limit and ten | |
| 11 | -- minutes, in milliseconds since the epoch). Only a running job's own are | |
| 12 | -- ever answered, with its token. | |
| 13 | CREATE TABLE brokered_secrets ( | |
| 14 | stand_in TEXT PRIMARY KEY, | |
| 15 | job_id TEXT NOT NULL, | |
| 16 | name TEXT NOT NULL, | |
| 17 | value TEXT NOT NULL, | |
| 18 | hosts TEXT NOT NULL, | |
| 19 | expires_at INTEGER NOT NULL | |
| 20 | ); | |
| 21 | CREATE INDEX brokered_secrets_by_job ON brokered_secrets (job_id); | |
| 22 | CREATE INDEX brokered_secrets_by_expiry ON brokered_secrets (expires_at); | |
| 23 | ||
| 24 | -- Whether a job was given any, so its log is masked for their values too | |
| 25 | -- without asking on every report. | |
| 26 | ALTER TABLE jobs ADD COLUMN brokered INTEGER NOT NULL DEFAULT 0; |
This file's history is long; its oldest lines are credited to the oldest commit read.