feat: support build-secrets in managed-mode
Metadata
Current evaluation
Merged into main. Implements build-secrets support in managed-mode by encoding secrets into the host-application environment for the managed instance to decode and re-render. Approved by two reviewers, passed CI, and achieved 100% diff coverage.
Suggested action: —
No scores available.
Issue body
This is done by encoding the secrets, in the host-application, into the environment of the managed instance. The managed instance then decodes this environment and uses it to re-render the project secrets.
- [ ] Have you followed the guidelines for contributing?
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you successfully run `tox`?
-----
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged into main. Implements build-secrets support in managed-mode by encoding secrets into the host-application environment for the managed instance to decode and re-render. Approved by two reviewers, passed CI, and achieved 100% diff coverage. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged into main. Adds build-secrets support in managed-mode by encoding secrets into the managed instance environment for decoding and re-rendering. Achieved 100% diff coverage. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #378 feat: enable build-secrets | rockcraft | merged | Merged to enable build-secrets. Approved by two reviewers, the update modifies six files (+48/-4). The target branch was adjusted to feature/build-secrets before final merge. | |
| #483 feat(secrets): support for 'basic' secrets | fetch-service | merged | Merged feature adding support for basic secrets. Approved by three reviewers, passed all CI checks, and modified 14 files with 240 additions and 14 deletions. | |
| #102 Support build secrets in destructive mode | craft-application | merged | Merged. Adds build secret support for destructive mode by updating the Application class. Approved by three reviewers with 100% diff coverage. Environment inheritance confirmed for shell and managed modes. | |
| #185 feat: add secrets API | craft-cli | merged | Merged the secrets API feature, adding Emitter.set_secrets to mask sensitive strings across all CLI outputs. Approved by two reviewers, passed CI checks, and achieved 100% diff coverage. Resolves issue 184. | |
| #657 feat!(secrets): remove secrets | craft-application | merged | Merged after two approvals and passing CI. The change removes built-in secrets functionality, deleting 595 lines across eight files. Applications can instead implement the prototype secrets service if needed. | |
| #100 Add support for build secrets | craft-application | closed | Build-time, host-provided secrets support was implemented and closed. The feature was added in pull request #104, enabling password-protected Git repositories and Ubuntu Pro integration. |