guettli/sharedinbox
1
0
Fork 0
Code Issues 21 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

dagger.Secret used? #142

New Issue
Closed
opened 2026-05-22 08:15:12 +00:00 by guettli · 1 comment
guettli commented 2026-05-22 08:15:12 +00:00 (Migrated from codeberg.org)
Copy Link
Copy Source

Dagger requires developers to explicitly define sensitive data using a special data type called dagger.Secret (rather than a standard String).

--> check the code-base if this is the case.

Write result into comment of this issue.

Dagger requires developers to explicitly define sensitive data using a special data type called dagger.Secret (rather than a standard String). --> check the code-base if this is the case. Write result into comment of this issue.
guettlibot commented 2026-05-22 14:06:46 +00:00 (Migrated from codeberg.org)
Copy Link
Copy Source

Result of code review: dagger.Secret usage

All actual sensitive credentials in ci/main.go properly use dagger.Secret:

Parameter Type Used in
sshKey *dagger.Secret Deployer, GenerateBuildHistory, BuildWebsite, PublishWebsite, DeployLinux, DeployApk
keystoreBase64 *dagger.Secret setupKeystore, BuildAndroidApk, DeployApk, SignAndroidBundle, PublishAndroid
keystorePassword *dagger.Secret same as above
playStoreConfig *dagger.Secret UploadToPlayStore, PublishAndroid
serviceAccountKey *dagger.Secret TestAndroidFirebase

The secrets are consumed via WithMountedSecret (for files, e.g. SSH key) and WithSecretVariable (for env vars, e.g. keystore, Play Store config) — both prevent the values from appearing in Dagger logs.

The only credentials NOT typed as dagger.Secret are the test passwords in WithStalwart (STALWART_PASS_B="secret", STALWART_PASS_C="secret"). These are hardcoded development passwords for the local Stalwart test server defined in the repo's stalwart-dev/ config — they are not production secrets and require no protection.

Conclusion: dagger.Secret is used correctly throughout the codebase. No changes needed.

## Result of code review: dagger.Secret usage All actual sensitive credentials in `ci/main.go` properly use `dagger.Secret`: | Parameter | Type | Used in | |---|---|---| | `sshKey` | `*dagger.Secret` | `Deployer`, `GenerateBuildHistory`, `BuildWebsite`, `PublishWebsite`, `DeployLinux`, `DeployApk` | | `keystoreBase64` | `*dagger.Secret` | `setupKeystore`, `BuildAndroidApk`, `DeployApk`, `SignAndroidBundle`, `PublishAndroid` | | `keystorePassword` | `*dagger.Secret` | same as above | | `playStoreConfig` | `*dagger.Secret` | `UploadToPlayStore`, `PublishAndroid` | | `serviceAccountKey` | `*dagger.Secret` | `TestAndroidFirebase` | The secrets are consumed via `WithMountedSecret` (for files, e.g. SSH key) and `WithSecretVariable` (for env vars, e.g. keystore, Play Store config) — both prevent the values from appearing in Dagger logs. **The only credentials NOT typed as `dagger.Secret`** are the test passwords in `WithStalwart` (`STALWART_PASS_B="secret"`, `STALWART_PASS_C="secret"`). These are hardcoded development passwords for the local Stalwart test server defined in the repo's `stalwart-dev/` config — they are not production secrets and require no protection. **Conclusion: `dagger.Secret` is used correctly throughout the codebase.** No changes needed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
NeedSupervisor
Issue escalated to a human supervisor; agentloop will skip it until cleared.
 State/InProgress
State/Later
State/Planned
automerge
Eligible for automatic merge by CI
 ci-failure
Issue opened by agentloop to track a failing CI workflow; used for deduplication.
 do-not-merge
Plan PR — review only, do not merge.
 loop/code
Add to run the built-in "code" prompt; override at prompts/code.md.
 loop/code-ci-pending
Prompt "code" finished; waiting for the PR's CI to pass before advancing.
 loop/code-done
Prompt "code" finished successfully.
 loop/code-in-process
Agent for the "code" prompt is currently running on this issue.
 loop/merge
Managed by agentloop
 loop/merge-done
Managed by agentloop
 loop/merge-in-process
Managed by agentloop
 loop/plan
Add to run the built-in "plan" prompt; override at prompts/plan.md.
 loop/plan-done
Prompt "plan" finished successfully.
 loop/plan-in-process
Agent for the "plan" prompt is currently running on this issue.
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
guettlibot guettli
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: guettli/sharedinbox#142