38 lines
1.3 KiB
Text
38 lines
1.3 KiB
Text
|
# secret-delivery domain contract v0.1.0
|
||
|
|
#
|
||
|
|
# JSON shape piped to stdin (or written to context file) for any integration mode
|
||
|
|
# step that consumes the secret-delivery domain.
|
||
|
|
#
|
||
|
|
# Provisioning's context assembler fills this structure from:
|
||
|
|
# - SOPS-encrypted workspace secrets
|
||
|
|
# - Component output values (e.g. registry URL from zot component)
|
||
|
|
# - Cabling literals (static values declared in integrations/<mode-id>.ncl)
|
||
|
|
|
||
|
|
let _SecretEntry = {
|
||
|
|
value | String
|
||
|
|
| doc "Plaintext secret value — decrypted by provisioning before delivery",
|
||
|
|
source | [| 'sops, 'component_output, 'literal |],
|
||
|
|
label | String | optional
|
||
|
|
| doc "Human-readable label for audit logs",
|
||
|
|
} in
|
||
|
|
|
||
|
|
let _SecretDeliveryContext = {
|
||
|
|
schema_version | String | default = "0.1.0",
|
||
|
|
workspace | String
|
||
|
|
| doc "Workspace identifier that sourced these secrets",
|
||
|
|
mode_id | String
|
||
|
|
| doc "Integration mode id that requested this delivery",
|
||
|
|
secrets | { _ | _SecretEntry }
|
||
|
|
| doc "Map of logical secret name → resolved entry",
|
||
|
|
metadata | {
|
||
|
|
delivered_at | String
|
||
|
|
| doc "ISO-8601 timestamp of delivery",
|
||
|
|
provisioning_version | String | optional,
|
||
|
|
} | optional,
|
||
|
|
} in
|
||
|
|
|
||
|
|
{
|
||
|
|
SecretEntry = _SecretEntry,
|
||
|
|
SecretDeliveryContext = _SecretDeliveryContext,
|
||
|
|
}
|