gitea/agents
8
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

agents: document single-line requirement for caller-skill secrets #67

Merged
ffaerber merged 1 commits from docs/caller-skills-singleline-secrets into main 2026-07-05 17:11:56 +02:00
Conversation 0 Commits 1 Files Changed 1
+6
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit ed17613d0d - Show all commits
.gitea/workflows/scripts/install-caller-skills.sh
+6
View File
@@ -18,6 +18,12 @@
# Required env (provided by the workflow step): NAME WORKSPACE SECRETS_JSON # Required env (provided by the workflow step): NAME WORKSPACE SECRETS_JSON
# (SECRETS_JSON = toJSON(secrets); passed so a caller's setup.sh can read repo-specific secrets # (SECRETS_JSON = toJSON(secrets); passed so a caller's setup.sh can read repo-specific secrets
# whose names this framework cannot know in advance.) # whose names this framework cannot know in advance.)
#
# IMPORTANT — caller-skill secrets read from SECRETS_JSON MUST be single-line. The runner masks a
# secret's value in logs by exact match, but toJSON(secrets) escapes newlines to '\n', so a MULTILINE
# secret (e.g. a raw PEM key) no longer matches the mask and would print in cleartext in the step's
# "expression evaluated to …" log line. Store multiline values base64-encoded (single-line) and
# decode them inside setup.sh. Single-line values mask correctly.
set -eu set -eu
DIR="${WORKSPACE:-$GITHUB_WORKSPACE}/.gitea/agent-skills" DIR="${WORKSPACE:-$GITHUB_WORKSPACE}/.gitea/agent-skills"