chadtmiller.com/knotless
git that lives in your Atmosphere account
1
10
A runner that logs in as the owner opens the secrets sealed to it
MergedMerged as 4a69863
chadtmiller.com/knotlessgit that lives in your Atmosphere account
What changes
dev.knotless.listSecretsanswers a repository's owner with every secret as before, and now withsealedon the rows sealed to the owner's own DID. A runner that logs in as the repository's owner, such as knotless.dev's own runner as chadtmiller.com, now gets the values sealed to it and opens them as any runner does. Rows sealed to other runners still come without a value. The runner itself is unchanged: it already skipped rows with no value.Why
This is the second gap in Org admins and runners on the owner's account can't use sealed secrets. Before this, a runner on the owner's account always got the owner's answer, never a value, so it could only use its
--secretsfile. Returning the ciphertext sealed to the caller exposes nothing new: only that runner's key opens it, and the caller who is that runner already holds the key. The issue's other gap, an organization's admin setting its secrets, is left open.How it was checked
secrets_reach_only_their_runnerputs a secret sealed to the owner and checks that the owner's list has that value and no other. The rest is left to CI.Shortcomings
An owner's CLI now receives the ciphertext of secrets sealed to the owner's DID, which it cannot open without the runner's key file.
knotless secret lsprints no values, so nothing shows.🤖 Generated with Claude Code