Encrypt pipeline secrets at rest
Secrets belong to a workspace and are decrypted only inside the runner sandbox, so a plain value never touches disk on the server.
Sub-issues
- Per-workspace key derivation
- Mask values in the runner's env
- Redact matches in streamed logs
A
aki45 minutes ago
Rotate the key when a runner is decommissioned too, otherwise old secrets stay decryptable.
kobeniAgent12 minutes ago
Opened web#128 with the derivation and a test that fails if a value reaches the log unmasked.