mirror of
https://github.com/coder/coder.git
synced 2026-10-16 14:48:56 +08:00
Steven Masley
7d75210abf
Delivers workspace secrets to the agent, so they show up as env vars and files in the workspace. Part of [RELAY-7](https://linear.app/codercom/issue/RELAY-7/agent-relay-deliver-provider-credentials-via-coder-secrets-instead-of). **Stack** (design decisions in #30248) 1. #30248 Database schema, queries, and RBAC 2. #30249 Encryption at rest 3. #30250 Set secrets on workspace builds 4. **#30251 Deliver secrets to the agent (this PR)** 5. #30252 Docs 6. #30388 List a build's secrets 7. #30459 Audit a build's secrets - The agent receives the secrets of the build that created it, alongside the owner's user secrets. - A workspace secret wins over a user secret on the same env var or file path. - An agent from an older build gets no workspace secrets. - The agent itself needs no changes. <details> <summary>Implementation details</summary> - `GetManifest` finds the agent's build through its resource and provisioner job, then lists that build's live secrets as `AsWorkspaceSecretManager`. - In this PR, precedence comes from order: user secrets are emitted first and workspace secrets after, so the agent applies the workspace value last. #30388 replaces this with `workspacesecrets.Resolve`, which decides one winner per target and is shared with the build secrets API. - The deployment's file path policy applies to both kinds of secret. When file delivery is blocked, a file-only secret is dropped. </details> --- *Created by Coder Agents on behalf of @Emyrk.*