secrets.json

{
    "$schema": "./secrets.schema.json",
    "note": "Secrets the audit cross-checks. `baseline` applies to every fleet repo (the App-signed merge-bot runs everywhere). `mechanisms` are per-target/per-feature additions: a repo requires the baseline plus the mechanisms its declared publish target (`targetMechanisms`) or declared type (`typeMechanisms`) maps to. All three mappings resolve from the registry entry rather than from workflow content: nothing reads a repo's Actions files to infer a mechanism, and `workflowNeeds` records what a mechanism needs to appear in a workflow for a human or agent reading the audit, rather than being a detector. `featureMechanisms` is shape-validated but claims nothing today, since the one feature it names (codecov) is claimed through `typeMechanisms` wherever the repo carries tests for that type instead. Baseline secrets are implicit and are NOT repeated in a repo's registry `requiredSecrets`, which lists only the domain-specific additions. `typeMechanisms` are per-language requirements: a `csharp` or `python` repo carrying tests for that language must carry the mapped mechanism (codecov) regardless of opt-in, a lint-only language other than Python excepted. A configured secret that no applicable mechanism claims is a stale-secret finding, and a present `forbids` secret is a defect. The schema still allows an `environments` block, whose `environmentSecrets` map would name what one environment carries and another does not, but the block has no per-repo dimension and downstream copies of this file are retired, so no repository has a place here to declare its environment names, and this file carries none. No tool would read one either: neither `spec/validate.py` nor `spec/audit.py` queries an environment-scoped store, so a clean audit is not evidence that an environment is configured.",
    "baseline": {
        "requires": ["CODEGEN_APP_CLIENT_ID", "CODEGEN_APP_PRIVATE_KEY"],
        "forbids": ["CODEGEN_APP_ID"],
        "workflowNeeds": ["actions/create-github-app-token"],
        "stores": ["actions", "dependabot"],
        "note": "The App-token secrets power the App-signed merge-bot (auto-merge that re-triggers downstream workflows), which every fleet repo runs; also consumed by codegen and the upstream-version tracker where present. Used via actions/create-github-app-token with the client-id input (not the deprecated app-id). The CODEGEN_* name is historical, not codegen-specific."
    },
    "mechanisms": {
        "nuget-oidc": {
            "kind": "oidc",
            "requires": ["NUGET_USERNAME"],
            "forbids": ["NUGET_API_KEY"],
            "workflowNeeds": ["NuGet/login", "id-token: write"],
            "stores": ["actions", "dependabot"]
        },
        "pypi-oidc": {
            "kind": "oidc",
            "requires": [],
            "forbids": ["PYPI_API_TOKEN", "TWINE_PASSWORD"],
            "workflowNeeds": ["environment: pypi", "id-token: write", "skip-existing: true"],
            "stores": []
        },
        "docker-hub": {
            "kind": "static-secret",
            "requires": ["DOCKER_HUB_USERNAME", "DOCKER_HUB_ACCESS_TOKEN"],
            "forbids": [],
            "workflowNeeds": [],
            "stores": ["actions", "dependabot"]
        },
        "codecov": {
            "kind": "static-secret",
            "requires": ["CODECOV_TOKEN"],
            "forbids": [],
            "workflowNeeds": ["codecov/codecov-action"],
            "stores": ["actions", "dependabot"],
            "note": "A csharp or python repo carrying tests for that language lists CODECOV_TOKEN in its registry requiredSecrets (unlike the implicit baseline secrets). Both stores: a workflow run triggered by a Dependabot PR reads the Dependabot secrets store, so without that copy the coverage upload silently skips on every bot PR. Coverage upload is report-only by default (fail_ci_if_error: false, so a Codecov hiccup never fails the gate). A repo may enforce a stricter threshold (e.g. 99%+) on top of that default."
        },
        "deploy-ssh": {
            "kind": "static-secret",
            "requires": [],
            "forbids": [],
            "workflowNeeds": ["environment:", "IdentitiesOnly=yes"],
            "stores": [],
            "note": "A deploy to a filesystem on a host the project owns, reached over SSH. requires and stores are empty deliberately rather than for want of credentials: the key and the host values are per-environment GitHub Environment secrets and variables, which neither validate.py nor audit.py queries. Listing the names would force them into the repo's registry requiredSecrets, which the audit resolves against the repository actions store, so a correctly configured repo would report every one of them as missing. The key is confined at the far end by an authorized_keys forced command rooted at the deploy tree, so the workflow names no host path."
        }
    },
    "targetMechanisms": {
        "nuget": "nuget-oidc",
        "pypi": "pypi-oidc",
        "docker": "docker-hub",
        "github-release": null,
        "self-hosted": "deploy-ssh"
    },
    "featureMechanisms": {
        "codecov": "codecov"
    },
    "typeMechanisms": {
        "csharp": "codecov",
        "python": "codecov"
    }
}