secrets.json

{
    "$schema": "./secrets.schema.json",
    "note": "Secrets the audit cross-checks. `baseline` applies to every fleet repo (the App-signed merge-bot runs everywhere). `mechanisms` are per-target/per-feature additions: a repo requires the baseline plus the mechanisms its declared publish target (`targetMechanisms`) or declared type (`typeMechanisms`) maps to. All three mappings resolve from the registry entry rather than from workflow content: nothing reads a repo's Actions files to infer a mechanism, and `workflowNeeds` records what a mechanism needs to appear in a workflow for a human or agent reading the audit, rather than being a detector. `featureMechanisms` is shape-validated but claims nothing today, since the one feature it names (codecov) is claimed through `typeMechanisms` at build profile instead. Baseline secrets are implicit and are NOT repeated in a repo's registry `requiredSecrets`, which lists only the domain-specific additions. `typeMechanisms` are per-language requirements: a `csharp` or `python` repo must carry the mapped mechanism (codecov) regardless of opt-in. A configured secret that no applicable mechanism claims is a stale-secret finding; a present `forbids` secret is a defect. `environments`, where a repo carries it, lists the per-environment GitHub Environment secrets and variables its deploy needs. It is operator documentation rather than part of the mechanism audit: no tool reads it, because neither `spec/validate.py` nor `spec/audit.py` can enumerate an environment-scoped store, so a clean audit is not evidence that an environment is configured. `environmentSecrets` names what one environment carries and another does not, so a name audit does not read a single-environment credential as missing everywhere else.",
    "baseline": {
        "requires": ["CODEGEN_APP_CLIENT_ID", "CODEGEN_APP_PRIVATE_KEY"],
        "forbids": ["CODEGEN_APP_ID"],
        "workflowNeeds": ["actions/create-github-app-token"],
        "stores": ["actions", "dependabot"],
        "note": "The App-token secrets power the App-signed merge-bot (auto-merge that re-triggers downstream workflows), which every fleet repo runs; also consumed by codegen and the upstream-version tracker where present. Used via actions/create-github-app-token with the client-id input (not the deprecated app-id). The CODEGEN_* name is historical, not codegen-specific."
    },
    "mechanisms": {
        "nuget-oidc": {
            "kind": "oidc",
            "requires": ["NUGET_USERNAME"],
            "forbids": ["NUGET_API_KEY"],
            "workflowNeeds": ["NuGet/login", "id-token: write"],
            "stores": ["actions", "dependabot"]
        },
        "pypi-oidc": {
            "kind": "oidc",
            "requires": [],
            "forbids": ["PYPI_API_TOKEN", "TWINE_PASSWORD"],
            "workflowNeeds": ["environment: pypi", "id-token: write", "skip-existing: true"],
            "stores": []
        },
        "docker-hub": {
            "kind": "static-secret",
            "requires": ["DOCKER_HUB_USERNAME", "DOCKER_HUB_ACCESS_TOKEN"],
            "forbids": [],
            "workflowNeeds": [],
            "stores": ["actions", "dependabot"]
        },
        "codecov": {
            "kind": "static-secret",
            "requires": ["CODECOV_TOKEN"],
            "forbids": [],
            "workflowNeeds": ["codecov/codecov-action"],
            "stores": ["actions", "dependabot"],
            "note": "A csharp or python repo lists CODECOV_TOKEN in its registry requiredSecrets (unlike the implicit baseline secrets). Both stores: a workflow run triggered by a Dependabot PR reads the Dependabot secrets store, so without that copy the coverage upload silently skips on every bot PR. Coverage upload is report-only by default (fail_ci_if_error: false, so a Codecov hiccup never fails the gate). A repo may enforce a stricter threshold (e.g. 99%+) on top of that default."
        },
        "deploy-ssh": {
            "kind": "static-secret",
            "requires": [],
            "forbids": [],
            "workflowNeeds": ["environment:", "IdentitiesOnly=yes"],
            "stores": [],
            "note": "A deploy to a filesystem on a host the project owns, reached over SSH. requires and stores are empty deliberately rather than for want of credentials: the key and the host values are per-environment GitHub Environment secrets and variables, which this file has no vocabulary for and neither validate.py nor audit.py can enumerate. Listing the names would force them into the repo's registry requiredSecrets, which the audit resolves against the repository actions store, so a correctly configured repo would report every one of them as missing. A repo declares them in its own environments block below instead. The key is confined at the far end by an authorized_keys forced command rooted at the deploy tree, so the workflow names no host path."
        }
    },
    "targetMechanisms": {
        "nuget": "nuget-oidc",
        "pypi": "pypi-oidc",
        "docker": "docker-hub",
        "github-release": null,
        "self-hosted": "deploy-ssh"
    },
    "featureMechanisms": {
        "codecov": "codecov"
    },
    "typeMechanisms": {
        "csharp": "codecov",
        "python": "codecov"
    }
}