v1.11.2

This release lets a trusted CICD job use repository secrets and reach named hosts, adds the settings page where the secrets are managed, and makes unknown job keys in .sigit/cicd an error.

#Secrets and egress hosts for trusted jobs

A job in .sigit/cicd can now list the secrets it needs and the hosts it may reach:

[[job]]
id = "deploy"
runs_on = ["linux", "amd64", "firecracker", "trusted"]
secrets = ["SMB_TOKEN"]
egress = ["api.smbcloud.xyz"]

The job gets each secret as an environment variable, and only the hosts it lists are reachable from its microVM. Both keys need trusted and firecracker in runs_on, and a trusted job is still read from the default branch, so a push cannot add a secret to a job. A job lists names only. If a named secret is not set on the repository, the job is not submitted and the run says which name is missing. A job can name up to 8 secrets and 8 hosts.

#CICD secrets settings page

Each repository has a CICD secrets page under Settings, at /:owner/:repo/settings/secrets. Owners and admins can add a secret, replace its value, or remove it. Names are capital letters, digits and underscores. A value can be up to 1024 characters, and a repository can hold 50 secrets.

Values are write-only. They are encrypted, never shown again after you save them, and kept out of request logs. Saving a name that already exists replaces its value.

#Unknown job keys are an error

A job in .sigit/cicd with a key siGit does not know now fails the pipeline definition, and the error names the key and lists the valid ones: id, runs_on, image, steps, needs, only, timeout_s, secrets and egress. Before, an unknown key was ignored without a message.

If a job used a misspelled key, for example timeout instead of timeout_s or secret instead of secrets, it never took effect. Fix the spelling or remove the line before your next push, or that pipeline will stop with the error.