mirror of
https://github.com/coder/coder.git
synced 2026-10-16 14:48:56 +08:00
Steven Masley
03cba25a63
`coder secret list` now shows the current workspace build's secrets next to your user secrets, and which user secrets they replace. Part of [RELAY-7](https://linear.app/codercom/issue/RELAY-7/agent-relay-deliver-provider-credentials-via-coder-secrets-instead-of). **Stack** (design decisions in #30248) 1. #30248 Database schema, queries, and RBAC 2. #30249 Encryption at rest 3. #30250 Set secrets on workspace builds 4. #30251 Deliver secrets to the agent 5. #30252 Docs 6. **#30388 List a build's secrets (this PR)** 7. #30459 Audit a build's secrets - New `GET /workspacebuilds/{workspacebuild}/secrets` lists a build's secrets (metadata only, never values) and which user secret each one replaces. - Inside a workspace, `coder secret list` includes the current build's secrets. Outside a workspace, use `--workspace` or `--build-id`. - The agent now exposes `CODER_WORKSPACE_BUILD_ID`, so the CLI knows which build it is running in. - The agent manifest and the new endpoint use one shared resolver, so they always agree on which secret wins. - The user secret API is unchanged. <details> <summary>Implementation details</summary> - The manifest carries `workspace_build_id`; the agent sets it as `CODER_WORKSPACE_BUILD_ID`. - `coderd/workspacesecrets.Resolve(user, build, policy)` decides which secret is delivered on each env var and file. The manifest no longer relies on entry order. - `codersdk.WorkspaceSecret` embeds `UserSecret` and adds `workspace_build_id`, `ephemeral`, `cleared_at`, `env_replaces`, and `file_replaces`. Secrets whose values a later build cleared are still listed, with `cleared_at` set. - CLI columns: `source` and `replaced by` are shown by default only when a build is included; `ephemeral` is opt-in. The CLI makes two requests: user secrets, then build secrets. - Agents that predate the build ID fall back to `CODER_WORKSPACE_ID` and its latest build. </details> <details> <summary>Decision log</summary> (existing decision log, unchanged) </details> --- *Created by Coder Agents on behalf of @Emyrk.*