feat(proto): CI-3 secrets, variables, environments, dispatch, permissions, cache (#10)

commit: 5c335b8558242842327d24d060f3a58a1e636ef4
author: brice · 8d ago · 2026-10-14 20:02 UTC
committer: bnema · 8d ago · 2026-10-14 20:02 UTC
parent: 49ac5fd
signature: SSH UnverifiedSHA256:VOCA5lYARHcbKDZ7GhTV45VmcjWnJ6ZQIBazj17LivA The key is unknown
refs: tag: v0.3.0

14 files · +3459 -269

M README.md +6 -3


@@ -2,7 +2,7 @@
2	2
3	3		The public API contract of [ermite](https://git.bnema.dev/bnema/ermite), a single-user Git forge: protobuf definitions for its ConnectRPC services and the Go code generated from them.
4	4
5		-	Status: early development. The contract defines nine services (below); the server that implements them is being built.
	5	+	Status: early development. The contract defines twelve services (below); the server that implements them is being built.
6	6
7	7		```go
8	8		import "bnema.dev/ermite-api/gen/ermite"

@@ -23,14 +23,17 @@ Handlers are mounted under `/-/api/` by the server. Errors are Connect codes.
23	23		\| `SessionService` \| `CreateLoginLink`, `SignOutEverywhere` (owner only) \|
24	24		\| `EventService` \| `Watch` (streamed, resumable) \|
25	25		\| `RunnerService` \| `RegisterRunner`, `FetchJob` (long poll), `UpdateJob` (steps, annotations), `AppendLog` (offset-idempotent), `Heartbeat`, `WatchJob` (cancel requests, streamed), `CompleteJob` (idempotent), `ResolveActions` (where to download the `uses:` actions), `UploadSummary` (job summary of a step); for CI runners \|
26		-	\| `RunService` \| `ListRuns`, `GetRun`, `GetJob`, `GetJobLog` (streamed, follow), `ListAnnotations`, `GetStepSummaries`, `CancelRun`, `RerunRun`, `ListChecks`, `ListRunners`, `RemoveRunner` \|
	26	+	\| `RunService` \| `ListRuns`, `GetRun`, `GetJob`, `GetJobLog` (streamed, follow), `ListAnnotations`, `GetStepSummaries`, `CancelRun`, `RerunRun`, `DispatchWorkflow`, `ListChecks`, `ListRunners`, `RemoveRunner` \|
	27	+	\| `SecretService` \| `SetSecret`, `ListSecrets` (names only, never values), `DeleteSecret`; scopes instance, repository and environment \|
	28	+	\| `VariableService` \| `SetVariable`, `GetVariable`, `ListVariables`, `DeleteVariable`; same scopes \|
	29	+	\| `EnvironmentService` \| `CreateEnvironment`, `ListEnvironments`, `DeleteEnvironment` \|
27	30		\| `ServerService` \| `GetVersion` (server version and feature list), `GetSigningKey` (commit signing key) \|
28	31
29	32		Tokens carry scopes only; presets such as `cli` or `agent` are a client concern.
30	33
31	34		## Layout
32	35
33		-	- `proto/ermite/`: `.proto` files of the `ermite` package, one per service (`repo`, `git`, `merge_request`, `token`, `session`, `event`, `server`, `runner`, `run`) plus shared `types`. Checked by `buf lint` and `buf breaking`.
	36	+	- `proto/ermite/`: `.proto` files of the `ermite` package, one per service (`repo`, `git`, `merge_request`, `token`, `session`, `event`, `server`, `runner`, `run`, `ci_settings`) plus shared `types`. Checked by `buf lint` and `buf breaking`.
34	37		- `gen/ermite/`: generated Go messages. `gen/ermite/ermiteconnect/`: generated Connect clients and handlers. Committed, never edited by hand.
35	38
36	39		## Generate

 The public API contract of [ermite](https://git.bnema.dev/bnema/ermite), a single-user Git forge: protobuf definitions for its ConnectRPC services and the Go code generated from them.
-Status: early development. The contract defines nine services (below); the server that implements them is being built.
+Status: early development. The contract defines twelve services (below); the server that implements them is being built.
 ```go
 import "bnema.dev/ermite-api/gen/ermite"
 | `SessionService` | `CreateLoginLink`, `SignOutEverywhere` (owner only) |
 | `EventService` | `Watch` (streamed, resumable) |
 | `RunnerService` | `RegisterRunner`, `FetchJob` (long poll), `UpdateJob` (steps, annotations), `AppendLog` (offset-idempotent), `Heartbeat`, `WatchJob` (cancel requests, streamed), `CompleteJob` (idempotent), `ResolveActions` (where to download the `uses:` actions), `UploadSummary` (job summary of a step); for CI runners |
-| `RunService` | `ListRuns`, `GetRun`, `GetJob`, `GetJobLog` (streamed, follow), `ListAnnotations`, `GetStepSummaries`, `CancelRun`, `RerunRun`, `ListChecks`, `ListRunners`, `RemoveRunner` |
+| `RunService` | `ListRuns`, `GetRun`, `GetJob`, `GetJobLog` (streamed, follow), `ListAnnotations`, `GetStepSummaries`, `CancelRun`, `RerunRun`, `DispatchWorkflow`, `ListChecks`, `ListRunners`, `RemoveRunner` |
+| `SecretService` | `SetSecret`, `ListSecrets` (names only, never values), `DeleteSecret`; scopes instance, repository and environment |
+| `VariableService` | `SetVariable`, `GetVariable`, `ListVariables`, `DeleteVariable`; same scopes |
+| `EnvironmentService` | `CreateEnvironment`, `ListEnvironments`, `DeleteEnvironment` |
 | `ServerService` | `GetVersion` (server version and feature list), `GetSigningKey` (commit signing key) |
 Tokens carry scopes only; presets such as `cli` or `agent` are a client concern.
 ## Layout
-- `proto/ermite/`: `.proto` files of the `ermite` package, one per service (`repo`, `git`, `merge_request`, `token`, `session`, `event`, `server`, `runner`, `run`) plus shared `types`. Checked by `buf lint` and `buf breaking`.
+- `proto/ermite/`: `.proto` files of the `ermite` package, one per service (`repo`, `git`, `merge_request`, `token`, `session`, `event`, `server`, `runner`, `run`, `ci_settings`) plus shared `types`. Checked by `buf lint` and `buf breaking`.
 - `gen/ermite/`: generated Go messages. `gen/ermite/ermiteconnect/`: generated Connect clients and handlers. Committed, never edited by hand.
 ## Generate

A gen/ermite/ci_settings.pb.go +1660 -0 generated file: collapsed

load diff

A gen/ermite/ermiteconnect/ci_settings.connect.go +515 -0

@@ -0,0 +1,515 @@
	1	+	// SPDX-License-Identifier: MIT
	2	+
	3	+	// Code generated by protoc-gen-connect-go. DO NOT EDIT.
	4	+	//
	5	+	// Source: ermite/ci_settings.proto
	6	+
	7	+	package ermiteconnect
	8	+
	9	+	import (
	10	+	ermite "bnema.dev/ermite-api/gen/ermite"
	11	+	connect "connectrpc.com/connect"
	12	+	context "context"
	13	+	errors "errors"
	14	+	http "net/http"
	15	+	strings "strings"
	16	+	)
	17	+
	18	+	// This is a compile-time assertion to ensure that this generated file and the connect package are
	19	+	// compatible. If you get a compiler error that this constant is not defined, this code was
	20	+	// generated with a version of connect newer than the one compiled into your binary. You can fix the
	21	+	// problem by either regenerating this code with an older version of connect or updating the connect
	22	+	// version compiled into your binary.
	23	+	const _ = connect.IsAtLeastVersion1_13_0
	24	+
	25	+	const (
	26	+	// SecretServiceName is the fully-qualified name of the SecretService service.
	27	+	SecretServiceName = "ermite.SecretService"
	28	+	// VariableServiceName is the fully-qualified name of the VariableService service.
	29	+	VariableServiceName = "ermite.VariableService"
	30	+	// EnvironmentServiceName is the fully-qualified name of the EnvironmentService service.
	31	+	EnvironmentServiceName = "ermite.EnvironmentService"
	32	+	)
	33	+
	34	+	// These constants are the fully-qualified names of the RPCs defined in this package. They're
	35	+	// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
	36	+	//
	37	+	// Note that these are different from the fully-qualified method names used by
	38	+	// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
	39	+	// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
	40	+	// period.
	41	+	const (
	42	+	// SecretServiceSetSecretProcedure is the fully-qualified name of the SecretService's SetSecret RPC.
	43	+	SecretServiceSetSecretProcedure = "/ermite.SecretService/SetSecret"
	44	+	// SecretServiceListSecretsProcedure is the fully-qualified name of the SecretService's ListSecrets
	45	+	// RPC.
	46	+	SecretServiceListSecretsProcedure = "/ermite.SecretService/ListSecrets"
	47	+	// SecretServiceDeleteSecretProcedure is the fully-qualified name of the SecretService's
	48	+	// DeleteSecret RPC.
	49	+	SecretServiceDeleteSecretProcedure = "/ermite.SecretService/DeleteSecret"
	50	+	// VariableServiceSetVariableProcedure is the fully-qualified name of the VariableService's
	51	+	// SetVariable RPC.
	52	+	VariableServiceSetVariableProcedure = "/ermite.VariableService/SetVariable"
	53	+	// VariableServiceGetVariableProcedure is the fully-qualified name of the VariableService's
	54	+	// GetVariable RPC.
	55	+	VariableServiceGetVariableProcedure = "/ermite.VariableService/GetVariable"
	56	+	// VariableServiceListVariablesProcedure is the fully-qualified name of the VariableService's
	57	+	// ListVariables RPC.
	58	+	VariableServiceListVariablesProcedure = "/ermite.VariableService/ListVariables"
	59	+	// VariableServiceDeleteVariableProcedure is the fully-qualified name of the VariableService's
	60	+	// DeleteVariable RPC.
	61	+	VariableServiceDeleteVariableProcedure = "/ermite.VariableService/DeleteVariable"
	62	+	// EnvironmentServiceCreateEnvironmentProcedure is the fully-qualified name of the
	63	+	// EnvironmentService's CreateEnvironment RPC.
	64	+	EnvironmentServiceCreateEnvironmentProcedure = "/ermite.EnvironmentService/CreateEnvironment"
	65	+	// EnvironmentServiceListEnvironmentsProcedure is the fully-qualified name of the
	66	+	// EnvironmentService's ListEnvironments RPC.
	67	+	EnvironmentServiceListEnvironmentsProcedure = "/ermite.EnvironmentService/ListEnvironments"
	68	+	// EnvironmentServiceDeleteEnvironmentProcedure is the fully-qualified name of the
	69	+	// EnvironmentService's DeleteEnvironment RPC.
	70	+	EnvironmentServiceDeleteEnvironmentProcedure = "/ermite.EnvironmentService/DeleteEnvironment"
	71	+	)
	72	+
	73	+	// SecretServiceClient is a client for the ermite.SecretService service.
	74	+	type SecretServiceClient interface {
	75	+	// SetSecret creates the secret or replaces its value. Fails with
	76	+	// invalid_argument if the name is not valid, if the value is empty or longer
	77	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	78	+	// environment of the scope does not exist, and with failed_precondition if
	79	+	// the server has no encryption key.
	80	+	SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error)
	81	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	82	+	// the secrets set in that scope, not the ones the scope inherits. It never
	83	+	// returns values.
	84	+	ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error)
	85	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	86	+	DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error)
	87	+	}
	88	+
	89	+	// NewSecretServiceClient constructs a client for the ermite.SecretService service. By default, it
	90	+	// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
	91	+	// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
	92	+	// connect.WithGRPCWeb() options.
	93	+	//
	94	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	95	+	// http://api.acme.com or https://acme.com/grpc).
	96	+	func NewSecretServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) SecretServiceClient {
	97	+	baseURL = strings.TrimRight(baseURL, "/")
	98	+	secretServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("SecretService").Methods()
	99	+	return &secretServiceClient{
	100	+	setSecret: connect.NewClient[ermite.SetSecretRequest, ermite.SetSecretResponse](
	101	+	httpClient,
	102	+	baseURL+SecretServiceSetSecretProcedure,
	103	+	connect.WithSchema(secretServiceMethods.ByName("SetSecret")),
	104	+	connect.WithClientOptions(opts...),
	105	+	),
	106	+	listSecrets: connect.NewClient[ermite.ListSecretsRequest, ermite.ListSecretsResponse](
	107	+	httpClient,
	108	+	baseURL+SecretServiceListSecretsProcedure,
	109	+	connect.WithSchema(secretServiceMethods.ByName("ListSecrets")),
	110	+	connect.WithClientOptions(opts...),
	111	+	),
	112	+	deleteSecret: connect.NewClient[ermite.DeleteSecretRequest, ermite.DeleteSecretResponse](
	113	+	httpClient,
	114	+	baseURL+SecretServiceDeleteSecretProcedure,
	115	+	connect.WithSchema(secretServiceMethods.ByName("DeleteSecret")),
	116	+	connect.WithClientOptions(opts...),
	117	+	),
	118	+	}
	119	+	}
	120	+
	121	+	// secretServiceClient implements SecretServiceClient.
	122	+	type secretServiceClient struct {
	123	+	setSecret *connect.Client[ermite.SetSecretRequest, ermite.SetSecretResponse]
	124	+	listSecrets *connect.Client[ermite.ListSecretsRequest, ermite.ListSecretsResponse]
	125	+	deleteSecret *connect.Client[ermite.DeleteSecretRequest, ermite.DeleteSecretResponse]
	126	+	}
	127	+
	128	+	// SetSecret calls ermite.SecretService.SetSecret.
	129	+	func (c secretServiceClient) SetSecret(ctx context.Context, req connect.Request[ermite.SetSecretRequest]) (*connect.Response[ermite.SetSecretResponse], error) {
	130	+	return c.setSecret.CallUnary(ctx, req)
	131	+	}
	132	+
	133	+	// ListSecrets calls ermite.SecretService.ListSecrets.
	134	+	func (c secretServiceClient) ListSecrets(ctx context.Context, req connect.Request[ermite.ListSecretsRequest]) (*connect.Response[ermite.ListSecretsResponse], error) {
	135	+	return c.listSecrets.CallUnary(ctx, req)
	136	+	}
	137	+
	138	+	// DeleteSecret calls ermite.SecretService.DeleteSecret.
	139	+	func (c secretServiceClient) DeleteSecret(ctx context.Context, req connect.Request[ermite.DeleteSecretRequest]) (*connect.Response[ermite.DeleteSecretResponse], error) {
	140	+	return c.deleteSecret.CallUnary(ctx, req)
	141	+	}
	142	+
	143	+	// SecretServiceHandler is an implementation of the ermite.SecretService service.
	144	+	type SecretServiceHandler interface {
	145	+	// SetSecret creates the secret or replaces its value. Fails with
	146	+	// invalid_argument if the name is not valid, if the value is empty or longer
	147	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	148	+	// environment of the scope does not exist, and with failed_precondition if
	149	+	// the server has no encryption key.
	150	+	SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error)
	151	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	152	+	// the secrets set in that scope, not the ones the scope inherits. It never
	153	+	// returns values.
	154	+	ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error)
	155	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	156	+	DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error)
	157	+	}
	158	+
	159	+	// NewSecretServiceHandler builds an HTTP handler from the service implementation. It returns the
	160	+	// path on which to mount the handler and the handler itself.
	161	+	//
	162	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	163	+	// and JSON codecs. They also support gzip compression.
	164	+	func NewSecretServiceHandler(svc SecretServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	165	+	secretServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("SecretService").Methods()
	166	+	secretServiceSetSecretHandler := connect.NewUnaryHandler(
	167	+	SecretServiceSetSecretProcedure,
	168	+	svc.SetSecret,
	169	+	connect.WithSchema(secretServiceMethods.ByName("SetSecret")),
	170	+	connect.WithHandlerOptions(opts...),
	171	+	)
	172	+	secretServiceListSecretsHandler := connect.NewUnaryHandler(
	173	+	SecretServiceListSecretsProcedure,
	174	+	svc.ListSecrets,
	175	+	connect.WithSchema(secretServiceMethods.ByName("ListSecrets")),
	176	+	connect.WithHandlerOptions(opts...),
	177	+	)
	178	+	secretServiceDeleteSecretHandler := connect.NewUnaryHandler(
	179	+	SecretServiceDeleteSecretProcedure,
	180	+	svc.DeleteSecret,
	181	+	connect.WithSchema(secretServiceMethods.ByName("DeleteSecret")),
	182	+	connect.WithHandlerOptions(opts...),
	183	+	)
	184	+	return "/ermite.SecretService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	185	+	switch r.URL.Path {
	186	+	case SecretServiceSetSecretProcedure:
	187	+	secretServiceSetSecretHandler.ServeHTTP(w, r)
	188	+	case SecretServiceListSecretsProcedure:
	189	+	secretServiceListSecretsHandler.ServeHTTP(w, r)
	190	+	case SecretServiceDeleteSecretProcedure:
	191	+	secretServiceDeleteSecretHandler.ServeHTTP(w, r)
	192	+	default:
	193	+	http.NotFound(w, r)
	194	+	}
	195	+	})
	196	+	}
	197	+
	198	+	// UnimplementedSecretServiceHandler returns CodeUnimplemented from all methods.
	199	+	type UnimplementedSecretServiceHandler struct{}
	200	+
	201	+	func (UnimplementedSecretServiceHandler) SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error) {
	202	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.SetSecret is not implemented"))
	203	+	}
	204	+
	205	+	func (UnimplementedSecretServiceHandler) ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error) {
	206	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.ListSecrets is not implemented"))
	207	+	}
	208	+
	209	+	func (UnimplementedSecretServiceHandler) DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error) {
	210	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.DeleteSecret is not implemented"))
	211	+	}
	212	+
	213	+	// VariableServiceClient is a client for the ermite.VariableService service.
	214	+	type VariableServiceClient interface {
	215	+	// SetVariable creates the variable or replaces its value. Fails with
	216	+	// invalid_argument if the name is not valid, if the value is longer than 48
	217	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	218	+	// environment of the scope does not exist. An empty value is allowed.
	219	+	SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error)
	220	+	// GetVariable returns one variable of one scope, with its value. Fails with
	221	+	// not_found if it does not exist in that scope.
	222	+	GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error)
	223	+	// ListVariables lists the variables of one scope, ordered by name, with
	224	+	// their values. It lists only the variables set in that scope.
	225	+	ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error)
	226	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	227	+	// exist.
	228	+	DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error)
	229	+	}
	230	+
	231	+	// NewVariableServiceClient constructs a client for the ermite.VariableService service. By default,
	232	+	// it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and
	233	+	// sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC()
	234	+	// or connect.WithGRPCWeb() options.
	235	+	//
	236	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	237	+	// http://api.acme.com or https://acme.com/grpc).
	238	+	func NewVariableServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) VariableServiceClient {
	239	+	baseURL = strings.TrimRight(baseURL, "/")
	240	+	variableServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("VariableService").Methods()
	241	+	return &variableServiceClient{
	242	+	setVariable: connect.NewClient[ermite.SetVariableRequest, ermite.SetVariableResponse](
	243	+	httpClient,
	244	+	baseURL+VariableServiceSetVariableProcedure,
	245	+	connect.WithSchema(variableServiceMethods.ByName("SetVariable")),
	246	+	connect.WithClientOptions(opts...),
	247	+	),
	248	+	getVariable: connect.NewClient[ermite.GetVariableRequest, ermite.GetVariableResponse](
	249	+	httpClient,
	250	+	baseURL+VariableServiceGetVariableProcedure,
	251	+	connect.WithSchema(variableServiceMethods.ByName("GetVariable")),
	252	+	connect.WithClientOptions(opts...),
	253	+	),
	254	+	listVariables: connect.NewClient[ermite.ListVariablesRequest, ermite.ListVariablesResponse](
	255	+	httpClient,
	256	+	baseURL+VariableServiceListVariablesProcedure,
	257	+	connect.WithSchema(variableServiceMethods.ByName("ListVariables")),
	258	+	connect.WithClientOptions(opts...),
	259	+	),
	260	+	deleteVariable: connect.NewClient[ermite.DeleteVariableRequest, ermite.DeleteVariableResponse](
	261	+	httpClient,
	262	+	baseURL+VariableServiceDeleteVariableProcedure,
	263	+	connect.WithSchema(variableServiceMethods.ByName("DeleteVariable")),
	264	+	connect.WithClientOptions(opts...),
	265	+	),
	266	+	}
	267	+	}
	268	+
	269	+	// variableServiceClient implements VariableServiceClient.
	270	+	type variableServiceClient struct {
	271	+	setVariable *connect.Client[ermite.SetVariableRequest, ermite.SetVariableResponse]
	272	+	getVariable *connect.Client[ermite.GetVariableRequest, ermite.GetVariableResponse]
	273	+	listVariables *connect.Client[ermite.ListVariablesRequest, ermite.ListVariablesResponse]
	274	+	deleteVariable *connect.Client[ermite.DeleteVariableRequest, ermite.DeleteVariableResponse]
	275	+	}
	276	+
	277	+	// SetVariable calls ermite.VariableService.SetVariable.
	278	+	func (c variableServiceClient) SetVariable(ctx context.Context, req connect.Request[ermite.SetVariableRequest]) (*connect.Response[ermite.SetVariableResponse], error) {
	279	+	return c.setVariable.CallUnary(ctx, req)
	280	+	}
	281	+
	282	+	// GetVariable calls ermite.VariableService.GetVariable.
	283	+	func (c variableServiceClient) GetVariable(ctx context.Context, req connect.Request[ermite.GetVariableRequest]) (*connect.Response[ermite.GetVariableResponse], error) {
	284	+	return c.getVariable.CallUnary(ctx, req)
	285	+	}
	286	+
	287	+	// ListVariables calls ermite.VariableService.ListVariables.
	288	+	func (c variableServiceClient) ListVariables(ctx context.Context, req connect.Request[ermite.ListVariablesRequest]) (*connect.Response[ermite.ListVariablesResponse], error) {
	289	+	return c.listVariables.CallUnary(ctx, req)
	290	+	}
	291	+
	292	+	// DeleteVariable calls ermite.VariableService.DeleteVariable.
	293	+	func (c variableServiceClient) DeleteVariable(ctx context.Context, req connect.Request[ermite.DeleteVariableRequest]) (*connect.Response[ermite.DeleteVariableResponse], error) {
	294	+	return c.deleteVariable.CallUnary(ctx, req)
	295	+	}
	296	+
	297	+	// VariableServiceHandler is an implementation of the ermite.VariableService service.
	298	+	type VariableServiceHandler interface {
	299	+	// SetVariable creates the variable or replaces its value. Fails with
	300	+	// invalid_argument if the name is not valid, if the value is longer than 48
	301	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	302	+	// environment of the scope does not exist. An empty value is allowed.
	303	+	SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error)
	304	+	// GetVariable returns one variable of one scope, with its value. Fails with
	305	+	// not_found if it does not exist in that scope.
	306	+	GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error)
	307	+	// ListVariables lists the variables of one scope, ordered by name, with
	308	+	// their values. It lists only the variables set in that scope.
	309	+	ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error)
	310	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	311	+	// exist.
	312	+	DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error)
	313	+	}
	314	+
	315	+	// NewVariableServiceHandler builds an HTTP handler from the service implementation. It returns the
	316	+	// path on which to mount the handler and the handler itself.
	317	+	//
	318	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	319	+	// and JSON codecs. They also support gzip compression.
	320	+	func NewVariableServiceHandler(svc VariableServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	321	+	variableServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("VariableService").Methods()
	322	+	variableServiceSetVariableHandler := connect.NewUnaryHandler(
	323	+	VariableServiceSetVariableProcedure,
	324	+	svc.SetVariable,
	325	+	connect.WithSchema(variableServiceMethods.ByName("SetVariable")),
	326	+	connect.WithHandlerOptions(opts...),
	327	+	)
	328	+	variableServiceGetVariableHandler := connect.NewUnaryHandler(
	329	+	VariableServiceGetVariableProcedure,
	330	+	svc.GetVariable,
	331	+	connect.WithSchema(variableServiceMethods.ByName("GetVariable")),
	332	+	connect.WithHandlerOptions(opts...),
	333	+	)
	334	+	variableServiceListVariablesHandler := connect.NewUnaryHandler(
	335	+	VariableServiceListVariablesProcedure,
	336	+	svc.ListVariables,
	337	+	connect.WithSchema(variableServiceMethods.ByName("ListVariables")),
	338	+	connect.WithHandlerOptions(opts...),
	339	+	)
	340	+	variableServiceDeleteVariableHandler := connect.NewUnaryHandler(
	341	+	VariableServiceDeleteVariableProcedure,
	342	+	svc.DeleteVariable,
	343	+	connect.WithSchema(variableServiceMethods.ByName("DeleteVariable")),
	344	+	connect.WithHandlerOptions(opts...),
	345	+	)
	346	+	return "/ermite.VariableService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	347	+	switch r.URL.Path {
	348	+	case VariableServiceSetVariableProcedure:
	349	+	variableServiceSetVariableHandler.ServeHTTP(w, r)
	350	+	case VariableServiceGetVariableProcedure:
	351	+	variableServiceGetVariableHandler.ServeHTTP(w, r)
	352	+	case VariableServiceListVariablesProcedure:
	353	+	variableServiceListVariablesHandler.ServeHTTP(w, r)
	354	+	case VariableServiceDeleteVariableProcedure:
	355	+	variableServiceDeleteVariableHandler.ServeHTTP(w, r)
	356	+	default:
	357	+	http.NotFound(w, r)
	358	+	}
	359	+	})
	360	+	}
	361	+
	362	+	// UnimplementedVariableServiceHandler returns CodeUnimplemented from all methods.
	363	+	type UnimplementedVariableServiceHandler struct{}
	364	+
	365	+	func (UnimplementedVariableServiceHandler) SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error) {
	366	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.SetVariable is not implemented"))
	367	+	}
	368	+
	369	+	func (UnimplementedVariableServiceHandler) GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error) {
	370	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.GetVariable is not implemented"))
	371	+	}
	372	+
	373	+	func (UnimplementedVariableServiceHandler) ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error) {
	374	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.ListVariables is not implemented"))
	375	+	}
	376	+
	377	+	func (UnimplementedVariableServiceHandler) DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error) {
	378	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.DeleteVariable is not implemented"))
	379	+	}
	380	+
	381	+	// EnvironmentServiceClient is a client for the ermite.EnvironmentService service.
	382	+	type EnvironmentServiceClient interface {
	383	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	384	+	// if the environment already exists (without regard to case), as GitHub's
	385	+	// create-or-update does. Fails with invalid_argument if the name is not
	386	+	// valid and with not_found if the repository does not exist.
	387	+	CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error)
	388	+	// ListEnvironments lists the environments of a repository, ordered by name.
	389	+	ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error)
	390	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	391	+	// Fails with not_found if it does not exist.
	392	+	DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error)
	393	+	}
	394	+
	395	+	// NewEnvironmentServiceClient constructs a client for the ermite.EnvironmentService service. By
	396	+	// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
	397	+	// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
	398	+	// connect.WithGRPC() or connect.WithGRPCWeb() options.
	399	+	//
	400	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	401	+	// http://api.acme.com or https://acme.com/grpc).
	402	+	func NewEnvironmentServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) EnvironmentServiceClient {
	403	+	baseURL = strings.TrimRight(baseURL, "/")
	404	+	environmentServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("EnvironmentService").Methods()
	405	+	return &environmentServiceClient{
	406	+	createEnvironment: connect.NewClient[ermite.CreateEnvironmentRequest, ermite.CreateEnvironmentResponse](
	407	+	httpClient,
	408	+	baseURL+EnvironmentServiceCreateEnvironmentProcedure,
	409	+	connect.WithSchema(environmentServiceMethods.ByName("CreateEnvironment")),
	410	+	connect.WithClientOptions(opts...),
	411	+	),
	412	+	listEnvironments: connect.NewClient[ermite.ListEnvironmentsRequest, ermite.ListEnvironmentsResponse](
	413	+	httpClient,
	414	+	baseURL+EnvironmentServiceListEnvironmentsProcedure,
	415	+	connect.WithSchema(environmentServiceMethods.ByName("ListEnvironments")),
	416	+	connect.WithClientOptions(opts...),
	417	+	),
	418	+	deleteEnvironment: connect.NewClient[ermite.DeleteEnvironmentRequest, ermite.DeleteEnvironmentResponse](
	419	+	httpClient,
	420	+	baseURL+EnvironmentServiceDeleteEnvironmentProcedure,
	421	+	connect.WithSchema(environmentServiceMethods.ByName("DeleteEnvironment")),
	422	+	connect.WithClientOptions(opts...),
	423	+	),
	424	+	}
	425	+	}
	426	+
	427	+	// environmentServiceClient implements EnvironmentServiceClient.
	428	+	type environmentServiceClient struct {
	429	+	createEnvironment *connect.Client[ermite.CreateEnvironmentRequest, ermite.CreateEnvironmentResponse]
	430	+	listEnvironments *connect.Client[ermite.ListEnvironmentsRequest, ermite.ListEnvironmentsResponse]
	431	+	deleteEnvironment *connect.Client[ermite.DeleteEnvironmentRequest, ermite.DeleteEnvironmentResponse]
	432	+	}
	433	+
	434	+	// CreateEnvironment calls ermite.EnvironmentService.CreateEnvironment.
	435	+	func (c environmentServiceClient) CreateEnvironment(ctx context.Context, req connect.Request[ermite.CreateEnvironmentRequest]) (*connect.Response[ermite.CreateEnvironmentResponse], error) {
	436	+	return c.createEnvironment.CallUnary(ctx, req)
	437	+	}
	438	+
	439	+	// ListEnvironments calls ermite.EnvironmentService.ListEnvironments.
	440	+	func (c environmentServiceClient) ListEnvironments(ctx context.Context, req connect.Request[ermite.ListEnvironmentsRequest]) (*connect.Response[ermite.ListEnvironmentsResponse], error) {
	441	+	return c.listEnvironments.CallUnary(ctx, req)
	442	+	}
	443	+
	444	+	// DeleteEnvironment calls ermite.EnvironmentService.DeleteEnvironment.
	445	+	func (c environmentServiceClient) DeleteEnvironment(ctx context.Context, req connect.Request[ermite.DeleteEnvironmentRequest]) (*connect.Response[ermite.DeleteEnvironmentResponse], error) {
	446	+	return c.deleteEnvironment.CallUnary(ctx, req)
	447	+	}
	448	+
	449	+	// EnvironmentServiceHandler is an implementation of the ermite.EnvironmentService service.
	450	+	type EnvironmentServiceHandler interface {
	451	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	452	+	// if the environment already exists (without regard to case), as GitHub's
	453	+	// create-or-update does. Fails with invalid_argument if the name is not
	454	+	// valid and with not_found if the repository does not exist.
	455	+	CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error)
	456	+	// ListEnvironments lists the environments of a repository, ordered by name.
	457	+	ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error)
	458	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	459	+	// Fails with not_found if it does not exist.
	460	+	DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error)
	461	+	}
	462	+
	463	+	// NewEnvironmentServiceHandler builds an HTTP handler from the service implementation. It returns
	464	+	// the path on which to mount the handler and the handler itself.
	465	+	//
	466	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	467	+	// and JSON codecs. They also support gzip compression.
	468	+	func NewEnvironmentServiceHandler(svc EnvironmentServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	469	+	environmentServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("EnvironmentService").Methods()
	470	+	environmentServiceCreateEnvironmentHandler := connect.NewUnaryHandler(
	471	+	EnvironmentServiceCreateEnvironmentProcedure,
	472	+	svc.CreateEnvironment,
	473	+	connect.WithSchema(environmentServiceMethods.ByName("CreateEnvironment")),
	474	+	connect.WithHandlerOptions(opts...),
	475	+	)
	476	+	environmentServiceListEnvironmentsHandler := connect.NewUnaryHandler(
	477	+	EnvironmentServiceListEnvironmentsProcedure,
	478	+	svc.ListEnvironments,
	479	+	connect.WithSchema(environmentServiceMethods.ByName("ListEnvironments")),
	480	+	connect.WithHandlerOptions(opts...),
	481	+	)
	482	+	environmentServiceDeleteEnvironmentHandler := connect.NewUnaryHandler(
	483	+	EnvironmentServiceDeleteEnvironmentProcedure,
	484	+	svc.DeleteEnvironment,
	485	+	connect.WithSchema(environmentServiceMethods.ByName("DeleteEnvironment")),
	486	+	connect.WithHandlerOptions(opts...),
	487	+	)
	488	+	return "/ermite.EnvironmentService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	489	+	switch r.URL.Path {
	490	+	case EnvironmentServiceCreateEnvironmentProcedure:
	491	+	environmentServiceCreateEnvironmentHandler.ServeHTTP(w, r)
	492	+	case EnvironmentServiceListEnvironmentsProcedure:
	493	+	environmentServiceListEnvironmentsHandler.ServeHTTP(w, r)
	494	+	case EnvironmentServiceDeleteEnvironmentProcedure:
	495	+	environmentServiceDeleteEnvironmentHandler.ServeHTTP(w, r)
	496	+	default:
	497	+	http.NotFound(w, r)
	498	+	}
	499	+	})
	500	+	}
	501	+
	502	+	// UnimplementedEnvironmentServiceHandler returns CodeUnimplemented from all methods.
	503	+	type UnimplementedEnvironmentServiceHandler struct{}
	504	+
	505	+	func (UnimplementedEnvironmentServiceHandler) CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error) {
	506	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.CreateEnvironment is not implemented"))
	507	+	}
	508	+
	509	+	func (UnimplementedEnvironmentServiceHandler) ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error) {
	510	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.ListEnvironments is not implemented"))
	511	+	}
	512	+
	513	+	func (UnimplementedEnvironmentServiceHandler) DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error) {
	514	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.DeleteEnvironment is not implemented"))
	515	+	}

@@ -0,0 +1,515 @@
	1	+	// SPDX-License-Identifier: MIT
	2	+
	3	+	// Code generated by protoc-gen-connect-go. DO NOT EDIT.
	4	+	//
	5	+	// Source: ermite/ci_settings.proto
	6	+
	7	+	package ermiteconnect
	8	+
	9	+	import (
	10	+	ermite "bnema.dev/ermite-api/gen/ermite"
	11	+	connect "connectrpc.com/connect"
	12	+	context "context"
	13	+	errors "errors"
	14	+	http "net/http"
	15	+	strings "strings"
	16	+	)
	17	+
	18	+	// This is a compile-time assertion to ensure that this generated file and the connect package are
	19	+	// compatible. If you get a compiler error that this constant is not defined, this code was
	20	+	// generated with a version of connect newer than the one compiled into your binary. You can fix the
	21	+	// problem by either regenerating this code with an older version of connect or updating the connect
	22	+	// version compiled into your binary.
	23	+	const _ = connect.IsAtLeastVersion1_13_0
	24	+
	25	+	const (
	26	+	// SecretServiceName is the fully-qualified name of the SecretService service.
	27	+	SecretServiceName = "ermite.SecretService"
	28	+	// VariableServiceName is the fully-qualified name of the VariableService service.
	29	+	VariableServiceName = "ermite.VariableService"
	30	+	// EnvironmentServiceName is the fully-qualified name of the EnvironmentService service.
	31	+	EnvironmentServiceName = "ermite.EnvironmentService"
	32	+	)
	33	+
	34	+	// These constants are the fully-qualified names of the RPCs defined in this package. They're
	35	+	// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
	36	+	//
	37	+	// Note that these are different from the fully-qualified method names used by
	38	+	// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
	39	+	// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
	40	+	// period.
	41	+	const (
	42	+	// SecretServiceSetSecretProcedure is the fully-qualified name of the SecretService's SetSecret RPC.
	43	+	SecretServiceSetSecretProcedure = "/ermite.SecretService/SetSecret"
	44	+	// SecretServiceListSecretsProcedure is the fully-qualified name of the SecretService's ListSecrets
	45	+	// RPC.
	46	+	SecretServiceListSecretsProcedure = "/ermite.SecretService/ListSecrets"
	47	+	// SecretServiceDeleteSecretProcedure is the fully-qualified name of the SecretService's
	48	+	// DeleteSecret RPC.
	49	+	SecretServiceDeleteSecretProcedure = "/ermite.SecretService/DeleteSecret"
	50	+	// VariableServiceSetVariableProcedure is the fully-qualified name of the VariableService's
	51	+	// SetVariable RPC.
	52	+	VariableServiceSetVariableProcedure = "/ermite.VariableService/SetVariable"
	53	+	// VariableServiceGetVariableProcedure is the fully-qualified name of the VariableService's
	54	+	// GetVariable RPC.
	55	+	VariableServiceGetVariableProcedure = "/ermite.VariableService/GetVariable"
	56	+	// VariableServiceListVariablesProcedure is the fully-qualified name of the VariableService's
	57	+	// ListVariables RPC.
	58	+	VariableServiceListVariablesProcedure = "/ermite.VariableService/ListVariables"
	59	+	// VariableServiceDeleteVariableProcedure is the fully-qualified name of the VariableService's
	60	+	// DeleteVariable RPC.
	61	+	VariableServiceDeleteVariableProcedure = "/ermite.VariableService/DeleteVariable"
	62	+	// EnvironmentServiceCreateEnvironmentProcedure is the fully-qualified name of the
	63	+	// EnvironmentService's CreateEnvironment RPC.
	64	+	EnvironmentServiceCreateEnvironmentProcedure = "/ermite.EnvironmentService/CreateEnvironment"
	65	+	// EnvironmentServiceListEnvironmentsProcedure is the fully-qualified name of the
	66	+	// EnvironmentService's ListEnvironments RPC.
	67	+	EnvironmentServiceListEnvironmentsProcedure = "/ermite.EnvironmentService/ListEnvironments"
	68	+	// EnvironmentServiceDeleteEnvironmentProcedure is the fully-qualified name of the
	69	+	// EnvironmentService's DeleteEnvironment RPC.
	70	+	EnvironmentServiceDeleteEnvironmentProcedure = "/ermite.EnvironmentService/DeleteEnvironment"
	71	+	)
	72	+
	73	+	// SecretServiceClient is a client for the ermite.SecretService service.
	74	+	type SecretServiceClient interface {
	75	+	// SetSecret creates the secret or replaces its value. Fails with
	76	+	// invalid_argument if the name is not valid, if the value is empty or longer
	77	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	78	+	// environment of the scope does not exist, and with failed_precondition if
	79	+	// the server has no encryption key.
	80	+	SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error)
	81	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	82	+	// the secrets set in that scope, not the ones the scope inherits. It never
	83	+	// returns values.
	84	+	ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error)
	85	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	86	+	DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error)
	87	+	}
	88	+
	89	+	// NewSecretServiceClient constructs a client for the ermite.SecretService service. By default, it
	90	+	// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
	91	+	// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
	92	+	// connect.WithGRPCWeb() options.
	93	+	//
	94	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	95	+	// http://api.acme.com or https://acme.com/grpc).
	96	+	func NewSecretServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) SecretServiceClient {
	97	+	baseURL = strings.TrimRight(baseURL, "/")
	98	+	secretServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("SecretService").Methods()
	99	+	return &secretServiceClient{
	100	+	setSecret: connect.NewClient[ermite.SetSecretRequest, ermite.SetSecretResponse](
	101	+	httpClient,
	102	+	baseURL+SecretServiceSetSecretProcedure,
	103	+	connect.WithSchema(secretServiceMethods.ByName("SetSecret")),
	104	+	connect.WithClientOptions(opts...),
	105	+	),
	106	+	listSecrets: connect.NewClient[ermite.ListSecretsRequest, ermite.ListSecretsResponse](
	107	+	httpClient,
	108	+	baseURL+SecretServiceListSecretsProcedure,
	109	+	connect.WithSchema(secretServiceMethods.ByName("ListSecrets")),
	110	+	connect.WithClientOptions(opts...),
	111	+	),
	112	+	deleteSecret: connect.NewClient[ermite.DeleteSecretRequest, ermite.DeleteSecretResponse](
	113	+	httpClient,
	114	+	baseURL+SecretServiceDeleteSecretProcedure,
	115	+	connect.WithSchema(secretServiceMethods.ByName("DeleteSecret")),
	116	+	connect.WithClientOptions(opts...),
	117	+	),
	118	+	}
	119	+	}
	120	+
	121	+	// secretServiceClient implements SecretServiceClient.
	122	+	type secretServiceClient struct {
	123	+	setSecret *connect.Client[ermite.SetSecretRequest, ermite.SetSecretResponse]
	124	+	listSecrets *connect.Client[ermite.ListSecretsRequest, ermite.ListSecretsResponse]
	125	+	deleteSecret *connect.Client[ermite.DeleteSecretRequest, ermite.DeleteSecretResponse]
	126	+	}
	127	+
	128	+	// SetSecret calls ermite.SecretService.SetSecret.
	129	+	func (c secretServiceClient) SetSecret(ctx context.Context, req connect.Request[ermite.SetSecretRequest]) (*connect.Response[ermite.SetSecretResponse], error) {
	130	+	return c.setSecret.CallUnary(ctx, req)
	131	+	}
	132	+
	133	+	// ListSecrets calls ermite.SecretService.ListSecrets.
	134	+	func (c secretServiceClient) ListSecrets(ctx context.Context, req connect.Request[ermite.ListSecretsRequest]) (*connect.Response[ermite.ListSecretsResponse], error) {
	135	+	return c.listSecrets.CallUnary(ctx, req)
	136	+	}
	137	+
	138	+	// DeleteSecret calls ermite.SecretService.DeleteSecret.
	139	+	func (c secretServiceClient) DeleteSecret(ctx context.Context, req connect.Request[ermite.DeleteSecretRequest]) (*connect.Response[ermite.DeleteSecretResponse], error) {
	140	+	return c.deleteSecret.CallUnary(ctx, req)
	141	+	}
	142	+
	143	+	// SecretServiceHandler is an implementation of the ermite.SecretService service.
	144	+	type SecretServiceHandler interface {
	145	+	// SetSecret creates the secret or replaces its value. Fails with
	146	+	// invalid_argument if the name is not valid, if the value is empty or longer
	147	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	148	+	// environment of the scope does not exist, and with failed_precondition if
	149	+	// the server has no encryption key.
	150	+	SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error)
	151	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	152	+	// the secrets set in that scope, not the ones the scope inherits. It never
	153	+	// returns values.
	154	+	ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error)
	155	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	156	+	DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error)
	157	+	}
	158	+
	159	+	// NewSecretServiceHandler builds an HTTP handler from the service implementation. It returns the
	160	+	// path on which to mount the handler and the handler itself.
	161	+	//
	162	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	163	+	// and JSON codecs. They also support gzip compression.
	164	+	func NewSecretServiceHandler(svc SecretServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	165	+	secretServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("SecretService").Methods()
	166	+	secretServiceSetSecretHandler := connect.NewUnaryHandler(
	167	+	SecretServiceSetSecretProcedure,
	168	+	svc.SetSecret,
	169	+	connect.WithSchema(secretServiceMethods.ByName("SetSecret")),
	170	+	connect.WithHandlerOptions(opts...),
	171	+	)
	172	+	secretServiceListSecretsHandler := connect.NewUnaryHandler(
	173	+	SecretServiceListSecretsProcedure,
	174	+	svc.ListSecrets,
	175	+	connect.WithSchema(secretServiceMethods.ByName("ListSecrets")),
	176	+	connect.WithHandlerOptions(opts...),
	177	+	)
	178	+	secretServiceDeleteSecretHandler := connect.NewUnaryHandler(
	179	+	SecretServiceDeleteSecretProcedure,
	180	+	svc.DeleteSecret,
	181	+	connect.WithSchema(secretServiceMethods.ByName("DeleteSecret")),
	182	+	connect.WithHandlerOptions(opts...),
	183	+	)
	184	+	return "/ermite.SecretService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	185	+	switch r.URL.Path {
	186	+	case SecretServiceSetSecretProcedure:
	187	+	secretServiceSetSecretHandler.ServeHTTP(w, r)
	188	+	case SecretServiceListSecretsProcedure:
	189	+	secretServiceListSecretsHandler.ServeHTTP(w, r)
	190	+	case SecretServiceDeleteSecretProcedure:
	191	+	secretServiceDeleteSecretHandler.ServeHTTP(w, r)
	192	+	default:
	193	+	http.NotFound(w, r)
	194	+	}
	195	+	})
	196	+	}
	197	+
	198	+	// UnimplementedSecretServiceHandler returns CodeUnimplemented from all methods.
	199	+	type UnimplementedSecretServiceHandler struct{}
	200	+
	201	+	func (UnimplementedSecretServiceHandler) SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error) {
	202	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.SetSecret is not implemented"))
	203	+	}
	204	+
	205	+	func (UnimplementedSecretServiceHandler) ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error) {
	206	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.ListSecrets is not implemented"))
	207	+	}
	208	+
	209	+	func (UnimplementedSecretServiceHandler) DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error) {
	210	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.DeleteSecret is not implemented"))
	211	+	}
	212	+
	213	+	// VariableServiceClient is a client for the ermite.VariableService service.
	214	+	type VariableServiceClient interface {
	215	+	// SetVariable creates the variable or replaces its value. Fails with
	216	+	// invalid_argument if the name is not valid, if the value is longer than 48
	217	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	218	+	// environment of the scope does not exist. An empty value is allowed.
	219	+	SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error)
	220	+	// GetVariable returns one variable of one scope, with its value. Fails with
	221	+	// not_found if it does not exist in that scope.
	222	+	GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error)
	223	+	// ListVariables lists the variables of one scope, ordered by name, with
	224	+	// their values. It lists only the variables set in that scope.
	225	+	ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error)
	226	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	227	+	// exist.
	228	+	DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error)
	229	+	}
	230	+
	231	+	// NewVariableServiceClient constructs a client for the ermite.VariableService service. By default,
	232	+	// it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and
	233	+	// sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC()
	234	+	// or connect.WithGRPCWeb() options.
	235	+	//
	236	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	237	+	// http://api.acme.com or https://acme.com/grpc).
	238	+	func NewVariableServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) VariableServiceClient {
	239	+	baseURL = strings.TrimRight(baseURL, "/")
	240	+	variableServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("VariableService").Methods()
	241	+	return &variableServiceClient{
	242	+	setVariable: connect.NewClient[ermite.SetVariableRequest, ermite.SetVariableResponse](
	243	+	httpClient,
	244	+	baseURL+VariableServiceSetVariableProcedure,
	245	+	connect.WithSchema(variableServiceMethods.ByName("SetVariable")),
	246	+	connect.WithClientOptions(opts...),
	247	+	),
	248	+	getVariable: connect.NewClient[ermite.GetVariableRequest, ermite.GetVariableResponse](
	249	+	httpClient,
	250	+	baseURL+VariableServiceGetVariableProcedure,
	251	+	connect.WithSchema(variableServiceMethods.ByName("GetVariable")),
	252	+	connect.WithClientOptions(opts...),
	253	+	),
	254	+	listVariables: connect.NewClient[ermite.ListVariablesRequest, ermite.ListVariablesResponse](
	255	+	httpClient,
	256	+	baseURL+VariableServiceListVariablesProcedure,
	257	+	connect.WithSchema(variableServiceMethods.ByName("ListVariables")),
	258	+	connect.WithClientOptions(opts...),
	259	+	),
	260	+	deleteVariable: connect.NewClient[ermite.DeleteVariableRequest, ermite.DeleteVariableResponse](
	261	+	httpClient,
	262	+	baseURL+VariableServiceDeleteVariableProcedure,
	263	+	connect.WithSchema(variableServiceMethods.ByName("DeleteVariable")),
	264	+	connect.WithClientOptions(opts...),
	265	+	),
	266	+	}
	267	+	}
	268	+
	269	+	// variableServiceClient implements VariableServiceClient.
	270	+	type variableServiceClient struct {
	271	+	setVariable *connect.Client[ermite.SetVariableRequest, ermite.SetVariableResponse]
	272	+	getVariable *connect.Client[ermite.GetVariableRequest, ermite.GetVariableResponse]
	273	+	listVariables *connect.Client[ermite.ListVariablesRequest, ermite.ListVariablesResponse]
	274	+	deleteVariable *connect.Client[ermite.DeleteVariableRequest, ermite.DeleteVariableResponse]
	275	+	}
	276	+
	277	+	// SetVariable calls ermite.VariableService.SetVariable.
	278	+	func (c variableServiceClient) SetVariable(ctx context.Context, req connect.Request[ermite.SetVariableRequest]) (*connect.Response[ermite.SetVariableResponse], error) {
	279	+	return c.setVariable.CallUnary(ctx, req)
	280	+	}
	281	+
	282	+	// GetVariable calls ermite.VariableService.GetVariable.
	283	+	func (c variableServiceClient) GetVariable(ctx context.Context, req connect.Request[ermite.GetVariableRequest]) (*connect.Response[ermite.GetVariableResponse], error) {
	284	+	return c.getVariable.CallUnary(ctx, req)
	285	+	}
	286	+
	287	+	// ListVariables calls ermite.VariableService.ListVariables.
	288	+	func (c variableServiceClient) ListVariables(ctx context.Context, req connect.Request[ermite.ListVariablesRequest]) (*connect.Response[ermite.ListVariablesResponse], error) {
	289	+	return c.listVariables.CallUnary(ctx, req)
	290	+	}
	291	+
	292	+	// DeleteVariable calls ermite.VariableService.DeleteVariable.
	293	+	func (c variableServiceClient) DeleteVariable(ctx context.Context, req connect.Request[ermite.DeleteVariableRequest]) (*connect.Response[ermite.DeleteVariableResponse], error) {
	294	+	return c.deleteVariable.CallUnary(ctx, req)
	295	+	}
	296	+
	297	+	// VariableServiceHandler is an implementation of the ermite.VariableService service.
	298	+	type VariableServiceHandler interface {
	299	+	// SetVariable creates the variable or replaces its value. Fails with
	300	+	// invalid_argument if the name is not valid, if the value is longer than 48
	301	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	302	+	// environment of the scope does not exist. An empty value is allowed.
	303	+	SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error)
	304	+	// GetVariable returns one variable of one scope, with its value. Fails with
	305	+	// not_found if it does not exist in that scope.
	306	+	GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error)
	307	+	// ListVariables lists the variables of one scope, ordered by name, with
	308	+	// their values. It lists only the variables set in that scope.
	309	+	ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error)
	310	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	311	+	// exist.
	312	+	DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error)
	313	+	}
	314	+
	315	+	// NewVariableServiceHandler builds an HTTP handler from the service implementation. It returns the
	316	+	// path on which to mount the handler and the handler itself.
	317	+	//
	318	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	319	+	// and JSON codecs. They also support gzip compression.
	320	+	func NewVariableServiceHandler(svc VariableServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	321	+	variableServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("VariableService").Methods()
	322	+	variableServiceSetVariableHandler := connect.NewUnaryHandler(
	323	+	VariableServiceSetVariableProcedure,
	324	+	svc.SetVariable,
	325	+	connect.WithSchema(variableServiceMethods.ByName("SetVariable")),
	326	+	connect.WithHandlerOptions(opts...),
	327	+	)
	328	+	variableServiceGetVariableHandler := connect.NewUnaryHandler(
	329	+	VariableServiceGetVariableProcedure,
	330	+	svc.GetVariable,
	331	+	connect.WithSchema(variableServiceMethods.ByName("GetVariable")),
	332	+	connect.WithHandlerOptions(opts...),
	333	+	)
	334	+	variableServiceListVariablesHandler := connect.NewUnaryHandler(
	335	+	VariableServiceListVariablesProcedure,
	336	+	svc.ListVariables,
	337	+	connect.WithSchema(variableServiceMethods.ByName("ListVariables")),
	338	+	connect.WithHandlerOptions(opts...),
	339	+	)
	340	+	variableServiceDeleteVariableHandler := connect.NewUnaryHandler(
	341	+	VariableServiceDeleteVariableProcedure,
	342	+	svc.DeleteVariable,
	343	+	connect.WithSchema(variableServiceMethods.ByName("DeleteVariable")),
	344	+	connect.WithHandlerOptions(opts...),
	345	+	)
	346	+	return "/ermite.VariableService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	347	+	switch r.URL.Path {
	348	+	case VariableServiceSetVariableProcedure:
	349	+	variableServiceSetVariableHandler.ServeHTTP(w, r)
	350	+	case VariableServiceGetVariableProcedure:
	351	+	variableServiceGetVariableHandler.ServeHTTP(w, r)
	352	+	case VariableServiceListVariablesProcedure:
	353	+	variableServiceListVariablesHandler.ServeHTTP(w, r)
	354	+	case VariableServiceDeleteVariableProcedure:
	355	+	variableServiceDeleteVariableHandler.ServeHTTP(w, r)
	356	+	default:
	357	+	http.NotFound(w, r)
	358	+	}
	359	+	})
	360	+	}
	361	+
	362	+	// UnimplementedVariableServiceHandler returns CodeUnimplemented from all methods.
	363	+	type UnimplementedVariableServiceHandler struct{}
	364	+
	365	+	func (UnimplementedVariableServiceHandler) SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error) {
	366	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.SetVariable is not implemented"))
	367	+	}
	368	+
	369	+	func (UnimplementedVariableServiceHandler) GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error) {
	370	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.GetVariable is not implemented"))
	371	+	}
	372	+
	373	+	func (UnimplementedVariableServiceHandler) ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error) {
	374	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.ListVariables is not implemented"))
	375	+	}
	376	+
	377	+	func (UnimplementedVariableServiceHandler) DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error) {
	378	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.DeleteVariable is not implemented"))
	379	+	}
	380	+
	381	+	// EnvironmentServiceClient is a client for the ermite.EnvironmentService service.
	382	+	type EnvironmentServiceClient interface {
	383	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	384	+	// if the environment already exists (without regard to case), as GitHub's
	385	+	// create-or-update does. Fails with invalid_argument if the name is not
	386	+	// valid and with not_found if the repository does not exist.
	387	+	CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error)
	388	+	// ListEnvironments lists the environments of a repository, ordered by name.
	389	+	ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error)
	390	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	391	+	// Fails with not_found if it does not exist.
	392	+	DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error)
	393	+	}
	394	+
	395	+	// NewEnvironmentServiceClient constructs a client for the ermite.EnvironmentService service. By
	396	+	// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
	397	+	// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
	398	+	// connect.WithGRPC() or connect.WithGRPCWeb() options.
	399	+	//
	400	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	401	+	// http://api.acme.com or https://acme.com/grpc).
	402	+	func NewEnvironmentServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) EnvironmentServiceClient {
	403	+	baseURL = strings.TrimRight(baseURL, "/")
	404	+	environmentServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("EnvironmentService").Methods()
	405	+	return &environmentServiceClient{
	406	+	createEnvironment: connect.NewClient[ermite.CreateEnvironmentRequest, ermite.CreateEnvironmentResponse](
	407	+	httpClient,
	408	+	baseURL+EnvironmentServiceCreateEnvironmentProcedure,
	409	+	connect.WithSchema(environmentServiceMethods.ByName("CreateEnvironment")),
	410	+	connect.WithClientOptions(opts...),
	411	+	),
	412	+	listEnvironments: connect.NewClient[ermite.ListEnvironmentsRequest, ermite.ListEnvironmentsResponse](
	413	+	httpClient,
	414	+	baseURL+EnvironmentServiceListEnvironmentsProcedure,
	415	+	connect.WithSchema(environmentServiceMethods.ByName("ListEnvironments")),
	416	+	connect.WithClientOptions(opts...),
	417	+	),
	418	+	deleteEnvironment: connect.NewClient[ermite.DeleteEnvironmentRequest, ermite.DeleteEnvironmentResponse](
	419	+	httpClient,
	420	+	baseURL+EnvironmentServiceDeleteEnvironmentProcedure,
	421	+	connect.WithSchema(environmentServiceMethods.ByName("DeleteEnvironment")),
	422	+	connect.WithClientOptions(opts...),
	423	+	),
	424	+	}
	425	+	}
	426	+
	427	+	// environmentServiceClient implements EnvironmentServiceClient.
	428	+	type environmentServiceClient struct {
	429	+	createEnvironment *connect.Client[ermite.CreateEnvironmentRequest, ermite.CreateEnvironmentResponse]
	430	+	listEnvironments *connect.Client[ermite.ListEnvironmentsRequest, ermite.ListEnvironmentsResponse]
	431	+	deleteEnvironment *connect.Client[ermite.DeleteEnvironmentRequest, ermite.DeleteEnvironmentResponse]
	432	+	}
	433	+
	434	+	// CreateEnvironment calls ermite.EnvironmentService.CreateEnvironment.
	435	+	func (c environmentServiceClient) CreateEnvironment(ctx context.Context, req connect.Request[ermite.CreateEnvironmentRequest]) (*connect.Response[ermite.CreateEnvironmentResponse], error) {
	436	+	return c.createEnvironment.CallUnary(ctx, req)
	437	+	}
	438	+
	439	+	// ListEnvironments calls ermite.EnvironmentService.ListEnvironments.
	440	+	func (c environmentServiceClient) ListEnvironments(ctx context.Context, req connect.Request[ermite.ListEnvironmentsRequest]) (*connect.Response[ermite.ListEnvironmentsResponse], error) {
	441	+	return c.listEnvironments.CallUnary(ctx, req)
	442	+	}
	443	+
	444	+	// DeleteEnvironment calls ermite.EnvironmentService.DeleteEnvironment.
	445	+	func (c environmentServiceClient) DeleteEnvironment(ctx context.Context, req connect.Request[ermite.DeleteEnvironmentRequest]) (*connect.Response[ermite.DeleteEnvironmentResponse], error) {
	446	+	return c.deleteEnvironment.CallUnary(ctx, req)
	447	+	}
	448	+
	449	+	// EnvironmentServiceHandler is an implementation of the ermite.EnvironmentService service.
	450	+	type EnvironmentServiceHandler interface {
	451	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	452	+	// if the environment already exists (without regard to case), as GitHub's
	453	+	// create-or-update does. Fails with invalid_argument if the name is not
	454	+	// valid and with not_found if the repository does not exist.
	455	+	CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error)
	456	+	// ListEnvironments lists the environments of a repository, ordered by name.
	457	+	ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error)
	458	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	459	+	// Fails with not_found if it does not exist.
	460	+	DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error)
	461	+	}
	462	+
	463	+	// NewEnvironmentServiceHandler builds an HTTP handler from the service implementation. It returns
	464	+	// the path on which to mount the handler and the handler itself.
	465	+	//
	466	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	467	+	// and JSON codecs. They also support gzip compression.
	468	+	func NewEnvironmentServiceHandler(svc EnvironmentServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	469	+	environmentServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("EnvironmentService").Methods()
	470	+	environmentServiceCreateEnvironmentHandler := connect.NewUnaryHandler(
	471	+	EnvironmentServiceCreateEnvironmentProcedure,
	472	+	svc.CreateEnvironment,
	473	+	connect.WithSchema(environmentServiceMethods.ByName("CreateEnvironment")),
	474	+	connect.WithHandlerOptions(opts...),
	475	+	)
	476	+	environmentServiceListEnvironmentsHandler := connect.NewUnaryHandler(
	477	+	EnvironmentServiceListEnvironmentsProcedure,
	478	+	svc.ListEnvironments,
	479	+	connect.WithSchema(environmentServiceMethods.ByName("ListEnvironments")),
	480	+	connect.WithHandlerOptions(opts...),
	481	+	)
	482	+	environmentServiceDeleteEnvironmentHandler := connect.NewUnaryHandler(
	483	+	EnvironmentServiceDeleteEnvironmentProcedure,
	484	+	svc.DeleteEnvironment,
	485	+	connect.WithSchema(environmentServiceMethods.ByName("DeleteEnvironment")),
	486	+	connect.WithHandlerOptions(opts...),
	487	+	)
	488	+	return "/ermite.EnvironmentService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	489	+	switch r.URL.Path {
	490	+	case EnvironmentServiceCreateEnvironmentProcedure:
	491	+	environmentServiceCreateEnvironmentHandler.ServeHTTP(w, r)
	492	+	case EnvironmentServiceListEnvironmentsProcedure:
	493	+	environmentServiceListEnvironmentsHandler.ServeHTTP(w, r)
	494	+	case EnvironmentServiceDeleteEnvironmentProcedure:
	495	+	environmentServiceDeleteEnvironmentHandler.ServeHTTP(w, r)
	496	+	default:
	497	+	http.NotFound(w, r)
	498	+	}
	499	+	})
	500	+	}
	501	+
	502	+	// UnimplementedEnvironmentServiceHandler returns CodeUnimplemented from all methods.
	503	+	type UnimplementedEnvironmentServiceHandler struct{}
	504	+
	505	+	func (UnimplementedEnvironmentServiceHandler) CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error) {
	506	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.CreateEnvironment is not implemented"))
	507	+	}
	508	+
	509	+	func (UnimplementedEnvironmentServiceHandler) ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error) {
	510	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.ListEnvironments is not implemented"))
	511	+	}
	512	+
	513	+	func (UnimplementedEnvironmentServiceHandler) DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error) {
	514	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.DeleteEnvironment is not implemented"))
	515	+	}

M gen/ermite/ermiteconnect/run.connect.go +57 -0


@@ -53,6 +53,9 @@ const (
53	53		RunServiceCancelRunProcedure = "/ermite.RunService/CancelRun"
54	54		// RunServiceRerunRunProcedure is the fully-qualified name of the RunService's RerunRun RPC.
55	55		RunServiceRerunRunProcedure = "/ermite.RunService/RerunRun"
	56	+	// RunServiceDispatchWorkflowProcedure is the fully-qualified name of the RunService's
	57	+	// DispatchWorkflow RPC.
	58	+	RunServiceDispatchWorkflowProcedure = "/ermite.RunService/DispatchWorkflow"
56	59		// RunServiceListChecksProcedure is the fully-qualified name of the RunService's ListChecks RPC.
57	60		RunServiceListChecksProcedure = "/ermite.RunService/ListChecks"
58	61		// RunServiceListRunnersProcedure is the fully-qualified name of the RunService's ListRunners RPC.

@@ -127,6 +130,21 @@ type RunServiceClient interface {
127	130		// with failed_precondition if the latest attempt has not completed, or if
128	131		// failed_only is set and no job failed. The new attempt is returned QUEUED.
129	132		RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)
	133	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
	134	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
	135	+	// scope on the repository. The workflow is read at ref and must have
	136	+	// "workflow_dispatch" among its events. The run has event
	137	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
	138	+	// actor; it is trusted when the caller is the owner and not trusted when the
	139	+	// caller is a token limited to branches. The run is returned QUEUED, before
	140	+	// any job has been given to a runner. Only servers with the feature
	141	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
	142	+	// not_found if the repository, the workflow file or ref does not exist,
	143	+	// with failed_precondition if the workflow does not declare
	144	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
	145	+	// missing while required without default, or has a value of the wrong type
	146	+	// or outside its choices, or if the workflow file is not valid.
	147	+	DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error)
130	148		// ListChecks lists the checks of a commit: for each job of each run on that
131	149		// sha, the one of the latest attempt, ordered by creation time then name.
132	150		// A commit without a run has no check: the list is empty, which is not an

@@ -203,6 +221,12 @@ func NewRunServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...
203	221		connect.WithSchema(runServiceMethods.ByName("RerunRun")),
204	222		connect.WithClientOptions(opts...),
205	223		),
	224	+	dispatchWorkflow: connect.NewClient[ermite.DispatchWorkflowRequest, ermite.DispatchWorkflowResponse](
	225	+	httpClient,
	226	+	baseURL+RunServiceDispatchWorkflowProcedure,
	227	+	connect.WithSchema(runServiceMethods.ByName("DispatchWorkflow")),
	228	+	connect.WithClientOptions(opts...),
	229	+	),
206	230		listChecks: connect.NewClient[ermite.ListChecksRequest, ermite.ListChecksResponse](
207	231		httpClient,
208	232		baseURL+RunServiceListChecksProcedure,

@@ -234,6 +258,7 @@ type runServiceClient struct {
234	258		getJobLog *connect.Client[ermite.GetJobLogRequest, ermite.GetJobLogResponse]
235	259		cancelRun *connect.Client[ermite.CancelRunRequest, ermite.CancelRunResponse]
236	260		rerunRun *connect.Client[ermite.RerunRunRequest, ermite.RerunRunResponse]
	261	+	dispatchWorkflow *connect.Client[ermite.DispatchWorkflowRequest, ermite.DispatchWorkflowResponse]
237	262		listChecks *connect.Client[ermite.ListChecksRequest, ermite.ListChecksResponse]
238	263		listRunners *connect.Client[ermite.ListRunnersRequest, ermite.ListRunnersResponse]
239	264		removeRunner *connect.Client[ermite.RemoveRunnerRequest, ermite.RemoveRunnerResponse]

@@ -279,6 +304,11 @@ func (c runServiceClient) RerunRun(ctx context.Context, req connect.Request[er
279	304		return c.rerunRun.CallUnary(ctx, req)
280	305		}
281	306
	307	+	// DispatchWorkflow calls ermite.RunService.DispatchWorkflow.
	308	+	func (c runServiceClient) DispatchWorkflow(ctx context.Context, req connect.Request[ermite.DispatchWorkflowRequest]) (*connect.Response[ermite.DispatchWorkflowResponse], error) {
	309	+	return c.dispatchWorkflow.CallUnary(ctx, req)
	310	+	}
	311	+
282	312		// ListChecks calls ermite.RunService.ListChecks.
283	313		func (c runServiceClient) ListChecks(ctx context.Context, req connect.Request[ermite.ListChecksRequest]) (*connect.Response[ermite.ListChecksResponse], error) {
284	314		return c.listChecks.CallUnary(ctx, req)

@@ -360,6 +390,21 @@ type RunServiceHandler interface {
360	390		// with failed_precondition if the latest attempt has not completed, or if
361	391		// failed_only is set and no job failed. The new attempt is returned QUEUED.
362	392		RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)
	393	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
	394	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
	395	+	// scope on the repository. The workflow is read at ref and must have
	396	+	// "workflow_dispatch" among its events. The run has event
	397	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
	398	+	// actor; it is trusted when the caller is the owner and not trusted when the
	399	+	// caller is a token limited to branches. The run is returned QUEUED, before
	400	+	// any job has been given to a runner. Only servers with the feature
	401	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
	402	+	// not_found if the repository, the workflow file or ref does not exist,
	403	+	// with failed_precondition if the workflow does not declare
	404	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
	405	+	// missing while required without default, or has a value of the wrong type
	406	+	// or outside its choices, or if the workflow file is not valid.
	407	+	DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error)
363	408		// ListChecks lists the checks of a commit: for each job of each run on that
364	409		// sha, the one of the latest attempt, ordered by creation time then name.
365	410		// A commit without a run has no check: the list is empty, which is not an

@@ -432,6 +477,12 @@ func NewRunServiceHandler(svc RunServiceHandler, opts ...connect.HandlerOption)
432	477		connect.WithSchema(runServiceMethods.ByName("RerunRun")),
433	478		connect.WithHandlerOptions(opts...),
434	479		)
	480	+	runServiceDispatchWorkflowHandler := connect.NewUnaryHandler(
	481	+	RunServiceDispatchWorkflowProcedure,
	482	+	svc.DispatchWorkflow,
	483	+	connect.WithSchema(runServiceMethods.ByName("DispatchWorkflow")),
	484	+	connect.WithHandlerOptions(opts...),
	485	+	)
435	486		runServiceListChecksHandler := connect.NewUnaryHandler(
436	487		RunServiceListChecksProcedure,
437	488		svc.ListChecks,

@@ -468,6 +519,8 @@ func NewRunServiceHandler(svc RunServiceHandler, opts ...connect.HandlerOption)
468	519		runServiceCancelRunHandler.ServeHTTP(w, r)
469	520		case RunServiceRerunRunProcedure:
470	521		runServiceRerunRunHandler.ServeHTTP(w, r)
	522	+	case RunServiceDispatchWorkflowProcedure:
	523	+	runServiceDispatchWorkflowHandler.ServeHTTP(w, r)
471	524		case RunServiceListChecksProcedure:
472	525		runServiceListChecksHandler.ServeHTTP(w, r)
473	526		case RunServiceListRunnersProcedure:

@@ -515,6 +568,10 @@ func (UnimplementedRunServiceHandler) RerunRun(context.Context, *connect.Request
515	568		return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.RerunRun is not implemented"))
516	569		}
517	570
	571	+	func (UnimplementedRunServiceHandler) DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error) {
	572	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.DispatchWorkflow is not implemented"))
	573	+	}
	574	+
518	575		func (UnimplementedRunServiceHandler) ListChecks(context.Context, connect.Request[ermite.ListChecksRequest]) (connect.Response[ermite.ListChecksResponse], error) {
519	576		return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.ListChecks is not implemented"))
520	577		}


@@ -53,6 +53,9 @@ const (
53	RunServiceCancelRunProcedure = "/ermite.RunService/CancelRun"	53		RunServiceCancelRunProcedure = "/ermite.RunService/CancelRun"
54	// RunServiceRerunRunProcedure is the fully-qualified name of the RunService's RerunRun RPC.	54		// RunServiceRerunRunProcedure is the fully-qualified name of the RunService's RerunRun RPC.
55	RunServiceRerunRunProcedure = "/ermite.RunService/RerunRun"	55		RunServiceRerunRunProcedure = "/ermite.RunService/RerunRun"
		56	+	// RunServiceDispatchWorkflowProcedure is the fully-qualified name of the RunService's
		57	+	// DispatchWorkflow RPC.
		58	+	RunServiceDispatchWorkflowProcedure = "/ermite.RunService/DispatchWorkflow"
56	// RunServiceListChecksProcedure is the fully-qualified name of the RunService's ListChecks RPC.	59		// RunServiceListChecksProcedure is the fully-qualified name of the RunService's ListChecks RPC.
57	RunServiceListChecksProcedure = "/ermite.RunService/ListChecks"	60		RunServiceListChecksProcedure = "/ermite.RunService/ListChecks"
58	// RunServiceListRunnersProcedure is the fully-qualified name of the RunService's ListRunners RPC.	61		// RunServiceListRunnersProcedure is the fully-qualified name of the RunService's ListRunners RPC.

@@ -127,6 +130,21 @@ type RunServiceClient interface {
127	// with failed_precondition if the latest attempt has not completed, or if	130		// with failed_precondition if the latest attempt has not completed, or if
128	// failed_only is set and no job failed. The new attempt is returned QUEUED.	131		// failed_only is set and no job failed. The new attempt is returned QUEUED.
129	RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)	132		RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)
		133	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
		134	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
		135	+	// scope on the repository. The workflow is read at ref and must have
		136	+	// "workflow_dispatch" among its events. The run has event
		137	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
		138	+	// actor; it is trusted when the caller is the owner and not trusted when the
		139	+	// caller is a token limited to branches. The run is returned QUEUED, before
		140	+	// any job has been given to a runner. Only servers with the feature
		141	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
		142	+	// not_found if the repository, the workflow file or ref does not exist,
		143	+	// with failed_precondition if the workflow does not declare
		144	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
		145	+	// missing while required without default, or has a value of the wrong type
		146	+	// or outside its choices, or if the workflow file is not valid.
		147	+	DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error)
130	// ListChecks lists the checks of a commit: for each job of each run on that	148		// ListChecks lists the checks of a commit: for each job of each run on that
131	// sha, the one of the latest attempt, ordered by creation time then name.	149		// sha, the one of the latest attempt, ordered by creation time then name.
132	// A commit without a run has no check: the list is empty, which is not an	150		// A commit without a run has no check: the list is empty, which is not an

@@ -203,6 +221,12 @@ func NewRunServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...
203	connect.WithSchema(runServiceMethods.ByName("RerunRun")),	221		connect.WithSchema(runServiceMethods.ByName("RerunRun")),
204	connect.WithClientOptions(opts...),	222		connect.WithClientOptions(opts...),
205	),	223		),
		224	+	dispatchWorkflow: connect.NewClient[ermite.DispatchWorkflowRequest, ermite.DispatchWorkflowResponse](
		225	+	httpClient,
		226	+	baseURL+RunServiceDispatchWorkflowProcedure,
		227	+	connect.WithSchema(runServiceMethods.ByName("DispatchWorkflow")),
		228	+	connect.WithClientOptions(opts...),
		229	+	),
206	listChecks: connect.NewClient[ermite.ListChecksRequest, ermite.ListChecksResponse](	230		listChecks: connect.NewClient[ermite.ListChecksRequest, ermite.ListChecksResponse](
207	httpClient,	231		httpClient,
208	baseURL+RunServiceListChecksProcedure,	232		baseURL+RunServiceListChecksProcedure,

@@ -234,6 +258,7 @@ type runServiceClient struct {
234	getJobLog *connect.Client[ermite.GetJobLogRequest, ermite.GetJobLogResponse]	258		getJobLog *connect.Client[ermite.GetJobLogRequest, ermite.GetJobLogResponse]
235	cancelRun *connect.Client[ermite.CancelRunRequest, ermite.CancelRunResponse]	259		cancelRun *connect.Client[ermite.CancelRunRequest, ermite.CancelRunResponse]
236	rerunRun *connect.Client[ermite.RerunRunRequest, ermite.RerunRunResponse]	260		rerunRun *connect.Client[ermite.RerunRunRequest, ermite.RerunRunResponse]
		261	+	dispatchWorkflow *connect.Client[ermite.DispatchWorkflowRequest, ermite.DispatchWorkflowResponse]
237	listChecks *connect.Client[ermite.ListChecksRequest, ermite.ListChecksResponse]	262		listChecks *connect.Client[ermite.ListChecksRequest, ermite.ListChecksResponse]
238	listRunners *connect.Client[ermite.ListRunnersRequest, ermite.ListRunnersResponse]	263		listRunners *connect.Client[ermite.ListRunnersRequest, ermite.ListRunnersResponse]
239	removeRunner *connect.Client[ermite.RemoveRunnerRequest, ermite.RemoveRunnerResponse]	264		removeRunner *connect.Client[ermite.RemoveRunnerRequest, ermite.RemoveRunnerResponse]

@@ -279,6 +304,11 @@ func (c runServiceClient) RerunRun(ctx context.Context, req connect.Request[er
279	return c.rerunRun.CallUnary(ctx, req)	304		return c.rerunRun.CallUnary(ctx, req)
280	}	305		}
281		306
		307	+	// DispatchWorkflow calls ermite.RunService.DispatchWorkflow.
		308	+	func (c runServiceClient) DispatchWorkflow(ctx context.Context, req connect.Request[ermite.DispatchWorkflowRequest]) (*connect.Response[ermite.DispatchWorkflowResponse], error) {
		309	+	return c.dispatchWorkflow.CallUnary(ctx, req)
		310	+	}
		311	+
282	// ListChecks calls ermite.RunService.ListChecks.	312		// ListChecks calls ermite.RunService.ListChecks.
283	func (c runServiceClient) ListChecks(ctx context.Context, req connect.Request[ermite.ListChecksRequest]) (*connect.Response[ermite.ListChecksResponse], error) {	313		func (c runServiceClient) ListChecks(ctx context.Context, req connect.Request[ermite.ListChecksRequest]) (*connect.Response[ermite.ListChecksResponse], error) {
284	return c.listChecks.CallUnary(ctx, req)	314		return c.listChecks.CallUnary(ctx, req)

@@ -360,6 +390,21 @@ type RunServiceHandler interface {
360	// with failed_precondition if the latest attempt has not completed, or if	390		// with failed_precondition if the latest attempt has not completed, or if
361	// failed_only is set and no job failed. The new attempt is returned QUEUED.	391		// failed_only is set and no job failed. The new attempt is returned QUEUED.
362	RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)	392		RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)
		393	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
		394	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
		395	+	// scope on the repository. The workflow is read at ref and must have
		396	+	// "workflow_dispatch" among its events. The run has event
		397	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
		398	+	// actor; it is trusted when the caller is the owner and not trusted when the
		399	+	// caller is a token limited to branches. The run is returned QUEUED, before
		400	+	// any job has been given to a runner. Only servers with the feature
		401	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
		402	+	// not_found if the repository, the workflow file or ref does not exist,
		403	+	// with failed_precondition if the workflow does not declare
		404	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
		405	+	// missing while required without default, or has a value of the wrong type
		406	+	// or outside its choices, or if the workflow file is not valid.
		407	+	DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error)
363	// ListChecks lists the checks of a commit: for each job of each run on that	408		// ListChecks lists the checks of a commit: for each job of each run on that
364	// sha, the one of the latest attempt, ordered by creation time then name.	409		// sha, the one of the latest attempt, ordered by creation time then name.
365	// A commit without a run has no check: the list is empty, which is not an	410		// A commit without a run has no check: the list is empty, which is not an

@@ -432,6 +477,12 @@ func NewRunServiceHandler(svc RunServiceHandler, opts ...connect.HandlerOption)
432	connect.WithSchema(runServiceMethods.ByName("RerunRun")),	477		connect.WithSchema(runServiceMethods.ByName("RerunRun")),
433	connect.WithHandlerOptions(opts...),	478		connect.WithHandlerOptions(opts...),
434	)	479		)
		480	+	runServiceDispatchWorkflowHandler := connect.NewUnaryHandler(
		481	+	RunServiceDispatchWorkflowProcedure,
		482	+	svc.DispatchWorkflow,
		483	+	connect.WithSchema(runServiceMethods.ByName("DispatchWorkflow")),
		484	+	connect.WithHandlerOptions(opts...),
		485	+	)
435	runServiceListChecksHandler := connect.NewUnaryHandler(	486		runServiceListChecksHandler := connect.NewUnaryHandler(
436	RunServiceListChecksProcedure,	487		RunServiceListChecksProcedure,
437	svc.ListChecks,	488		svc.ListChecks,

@@ -468,6 +519,8 @@ func NewRunServiceHandler(svc RunServiceHandler, opts ...connect.HandlerOption)
468	runServiceCancelRunHandler.ServeHTTP(w, r)	519		runServiceCancelRunHandler.ServeHTTP(w, r)
469	case RunServiceRerunRunProcedure:	520		case RunServiceRerunRunProcedure:
470	runServiceRerunRunHandler.ServeHTTP(w, r)	521		runServiceRerunRunHandler.ServeHTTP(w, r)
		522	+	case RunServiceDispatchWorkflowProcedure:
		523	+	runServiceDispatchWorkflowHandler.ServeHTTP(w, r)
471	case RunServiceListChecksProcedure:	524		case RunServiceListChecksProcedure:
472	runServiceListChecksHandler.ServeHTTP(w, r)	525		runServiceListChecksHandler.ServeHTTP(w, r)
473	case RunServiceListRunnersProcedure:	526		case RunServiceListRunnersProcedure:

@@ -515,6 +568,10 @@ func (UnimplementedRunServiceHandler) RerunRun(context.Context, *connect.Request
515	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.RerunRun is not implemented"))	568		return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.RerunRun is not implemented"))
516	}	569		}
517		570
		571	+	func (UnimplementedRunServiceHandler) DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error) {
		572	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.DispatchWorkflow is not implemented"))
		573	+	}
		574	+
518	func (UnimplementedRunServiceHandler) ListChecks(context.Context, connect.Request[ermite.ListChecksRequest]) (connect.Response[ermite.ListChecksResponse], error) {	575		func (UnimplementedRunServiceHandler) ListChecks(context.Context, connect.Request[ermite.ListChecksRequest]) (connect.Response[ermite.ListChecksResponse], error) {
519	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.ListChecks is not implemented"))	576		return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.ListChecks is not implemented"))
520	}	577		}

M gen/ermite/run.pb.go +272 -100 generated file: collapsed

load diff

M gen/ermite/runner.pb.go +400 -150


@@ -39,6 +39,11 @@ const (
39	39		CiStatus_CI_STATUS_IN_PROGRESS CiStatus = 2
40	40		// Over. The conclusion says how it ended.
41	41		CiStatus_CI_STATUS_COMPLETED CiStatus = 3
	42	+	// Held back by a concurrency group: another run or job of the group is
	43	+	// running, or a newer one is waiting (see RunJob.concurrency_group). Only for
	44	+	// jobs and checks, and only from servers with the feature "ci.concurrency";
	45	+	// a client that does not know the value shows it as queued.
	46	+	CiStatus_CI_STATUS_PENDING CiStatus = 4
42	47		)
43	48
44	49		// Enum value maps for CiStatus.

@@ -48,12 +53,14 @@ var (
48	53		1: "CI_STATUS_QUEUED",
49	54		2: "CI_STATUS_IN_PROGRESS",
50	55		3: "CI_STATUS_COMPLETED",
	56	+	4: "CI_STATUS_PENDING",
51	57		}
52	58		CiStatus_value = map[string]int32{
53	59		"CI_STATUS_UNSPECIFIED": 0,
54	60		"CI_STATUS_QUEUED": 1,
55	61		"CI_STATUS_IN_PROGRESS": 2,
56	62		"CI_STATUS_COMPLETED": 3,
	63	+	"CI_STATUS_PENDING": 4,
57	64		}
58	65		)
59	66

@@ -819,14 +826,56 @@ type Job struct {
819	826		// "secrets.GITHUB_TOKEN" of the job: "ermitegh_" and 43 base64url characters
820	827		// (32 random bytes, no padding). Unlike job_token it is meant for the code of
821	828		// the job: the runner gives it to the sandbox (actions/checkout clones with
822		-	// it). It can only read the repository of the run (read-only, whatever
823		-	// "permissions:" says), and is valid from the assignment until the job ends
	829	+	// it). It can only act on the repository of the run: read-only from servers
	830	+	// without the feature "ci.secrets", whatever "permissions:" says, and with
	831	+	// the rights of permissions from those that have it (never more than read
	832	+	// when trusted is false). It is valid from the assignment until the job ends
824	833		// (it is revoked then, on cancellation and when the job is lost). It is a
825	834		// secret: the runner registers it in its masker before anything runs, and
826	835		// neither the runner nor the server logs it. It is shown only in this
827	836		// response, or in a repeat of the same poll_id; a new assignment of the same
828	837		// job has a new one. Empty from servers without the feature "ci.actions".
829		-	GithubToken string `protobuf:"bytes,15,opt,name=github_token,json=githubToken,proto3" json:"github_token,omitempty"`
	838	+	GithubToken string `protobuf:"bytes,15,opt,name=github_token,json=githubToken,proto3" json:"github_token,omitempty"`
	839	+	// Secrets are the secrets of the job by name (upper case), in plain text:
	840	+	// the ones the job's workflow refers to, from the instance, the repository
	841	+	// and the environment, with the environment overriding the repository and
	842	+	// the repository the instance. The server picks them; the runner uses them
	843	+	// as they are. They are empty when the job is not trusted, when the job
	844	+	// refers to none, and from servers without the feature "ci.secrets"; the
	845	+	// "GITHUB_TOKEN" secret is github_token, not an entry here. They travel only
	846	+	// over the runner's authenticated channel. The runner never logs them, never
	847	+	// writes them to disk or to its recovery state, and registers them in its
	848	+	// log masker before the first step runs, as GitHub's runner does: each value
	849	+	// trimmed, each non-empty trimmed line of it (split on CR and LF), and the
	850	+	// encoded forms of each. The server never stores them in the run record nor
	851	+	// logs them. Treat the whole map as a secret.
	852	+	Secrets map[string]string `protobuf:"bytes,16,rep,name=secrets,proto3" json:"secrets,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	853	+	// Vars are the configuration variables of the job by name (upper case),
	854	+	// already merged by the server with environment over repository over
	855	+	// instance. They are not secret. The same values are in the "vars" context
	856	+	// of contexts, which the runner may use instead. Empty from servers without
	857	+	// the feature "ci.secrets".
	858	+	Vars map[string]string `protobuf:"bytes,17,rep,name=vars,proto3" json:"vars,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	859	+	// Environment is the name of the environment the job deploys to (the
	860	+	// evaluated "environment:" of the job). Empty when the job has none. It is
	861	+	// environment that secrets and vars were resolved for.
	862	+	Environment string `protobuf:"bytes,18,opt,name=environment,proto3" json:"environment,omitempty"`
	863	+	// Permissions are the effective permissions of github_token. Unset from
	864	+	// servers without the feature "ci.secrets"; the token is then read-only.
	865	+	Permissions *JobPermissions `protobuf:"bytes,19,opt,name=permissions,proto3" json:"permissions,omitempty"`
	866	+	// Cache tells the runner which cache entries the job may read and write.
	867	+	// Unset when the server gives the job no cache (the runner then serves no
	868	+	// cache) and from servers without the feature "ci.cache".
	869	+	Cache *JobCache `protobuf:"bytes,20,opt,name=cache,proto3" json:"cache,omitempty"`
	870	+	// Trusted is true when the run's actor is the owner (or a re-run of a
	871	+	// trusted run by the owner): only then are secrets sent and a write
	872	+	// permission granted. It is false when the actor is a token limited to
	873	+	// branches (an automated agent could otherwise print any secret by pushing a
	874	+	// workflow) and for a re-run of such a run, and then secrets is empty and
	875	+	// github_token is read-only whatever "permissions:" says. The runner states
	876	+	// this in the log of "Set up job". False from servers that do not send it:
	877	+	// the safe reading.
	878	+	Trusted bool `protobuf:"varint,21,opt,name=trusted,proto3" json:"trusted,omitempty"`
830	879		unknownFields protoimpl.UnknownFields
831	880		sizeCache protoimpl.SizeCache
832	881		}

@@ -966,6 +1015,170 @@ func (x *Job) GetGithubToken() string {
966	1015		return ""
967	1016		}
968	1017
	1018	+	func (x *Job) GetSecrets() map[string]string {
	1019	+	if x != nil {
	1020	+	return x.Secrets
	1021	+	}
	1022	+	return nil
	1023	+	}
	1024	+
	1025	+	func (x *Job) GetVars() map[string]string {
	1026	+	if x != nil {
	1027	+	return x.Vars
	1028	+	}
	1029	+	return nil
	1030	+	}
	1031	+
	1032	+	func (x *Job) GetEnvironment() string {
	1033	+	if x != nil {
	1034	+	return x.Environment
	1035	+	}
	1036	+	return ""
	1037	+	}
	1038	+
	1039	+	func (x Job) GetPermissions() JobPermissions {
	1040	+	if x != nil {
	1041	+	return x.Permissions
	1042	+	}
	1043	+	return nil
	1044	+	}
	1045	+
	1046	+	func (x Job) GetCache() JobCache {
	1047	+	if x != nil {
	1048	+	return x.Cache
	1049	+	}
	1050	+	return nil
	1051	+	}
	1052	+
	1053	+	func (x *Job) GetTrusted() bool {
	1054	+	if x != nil {
	1055	+	return x.Trusted
	1056	+	}
	1057	+	return false
	1058	+	}
	1059	+
	1060	+	// JobPermissions are the permissions of the job repository token, with the
	1061	+	// keys and values of the "permissions:" of a GitHub workflow.
	1062	+	type JobPermissions struct {
	1063	+	state protoimpl.MessageState `protogen:"open.v1"`
	1064	+	// Levels maps a permission key ("contents", "pull-requests", "id-token",
	1065	+	// "actions", ...) to "read", "write" or "none". They are the permissions in
	1066	+	// effect after the server merged the workflow's and the job's "permissions:"
	1067	+	// (and the caller's, for a reusable workflow) and applied the trust rule of
	1068	+	// Job.trusted; a key absent from the map is "none". Keys are lowercase as in
	1069	+	// the workflow. The runner prints them in "Set up job" and does not
	1070	+	// enforce them: the server checks the token.
	1071	+	Levels map[string]string `protobuf:"bytes,1,rep,name=levels,proto3" json:"levels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	1072	+	unknownFields protoimpl.UnknownFields
	1073	+	sizeCache protoimpl.SizeCache
	1074	+	}
	1075	+
	1076	+	func (x *JobPermissions) Reset() {
	1077	+	*x = JobPermissions{}
	1078	+	mi := &file_ermite_runner_proto_msgTypes[5]
	1079	+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	1080	+	ms.StoreMessageInfo(mi)
	1081	+	}
	1082	+
	1083	+	func (x *JobPermissions) String() string {
	1084	+	return protoimpl.X.MessageStringOf(x)
	1085	+	}
	1086	+
	1087	+	func (*JobPermissions) ProtoMessage() {}
	1088	+
	1089	+	func (x *JobPermissions) ProtoReflect() protoreflect.Message {
	1090	+	mi := &file_ermite_runner_proto_msgTypes[5]
	1091	+	if x != nil {
	1092	+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	1093	+	if ms.LoadMessageInfo() == nil {
	1094	+	ms.StoreMessageInfo(mi)
	1095	+	}
	1096	+	return ms
	1097	+	}
	1098	+	return mi.MessageOf(x)
	1099	+	}
	1100	+
	1101	+	// Deprecated: Use JobPermissions.ProtoReflect.Descriptor instead.
	1102	+	func (*JobPermissions) Descriptor() ([]byte, []int) {
	1103	+	return file_ermite_runner_proto_rawDescGZIP(), []int{5}
	1104	+	}
	1105	+
	1106	+	func (x *JobPermissions) GetLevels() map[string]string {
	1107	+	if x != nil {
	1108	+	return x.Levels
	1109	+	}
	1110	+	return nil
	1111	+	}
	1112	+
	1113	+	// JobCache is the scope of the cache of one job. The cache is served by the
	1114	+	// runner and shared by the jobs of a repository, as GitHub scopes it.
	1115	+	type JobCache struct {
	1116	+	state protoimpl.MessageState `protogen:"open.v1"`
	1117	+	// Repository is the name of the repository whose cache the job uses. Entries
	1118	+	// of another repository are never visible to it.
	1119	+	Repository string `protobuf:"bytes,1,opt,name=repository,proto3" json:"repository,omitempty"`
	1120	+	// WriteRef is the only ref the job may save entries under, for example
	1121	+	// "refs/heads/main" or "refs/pull/7/merge".
	1122	+	WriteRef string `protobuf:"bytes,2,opt,name=write_ref,json=writeRef,proto3" json:"write_ref,omitempty"`
	1123	+	// ReadRefs are the refs the job may restore entries from, most specific
	1124	+	// first: the ref of the run, then the base branch for a pull request, then
	1125	+	// the default branch. Entries under other refs are never restored.
	1126	+	ReadRefs []string `protobuf:"bytes,3,rep,name=read_refs,json=readRefs,proto3" json:"read_refs,omitempty"`
	1127	+	unknownFields protoimpl.UnknownFields
	1128	+	sizeCache protoimpl.SizeCache
	1129	+	}
	1130	+
	1131	+	func (x *JobCache) Reset() {
	1132	+	*x = JobCache{}
	1133	+	mi := &file_ermite_runner_proto_msgTypes[6]
	1134	+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	1135	+	ms.StoreMessageInfo(mi)
	1136	+	}
	1137	+
	1138	+	func (x *JobCache) String() string {
	1139	+	return protoimpl.X.MessageStringOf(x)
	1140	+	}
	1141	+
	1142	+	func (*JobCache) ProtoMessage() {}
	1143	+
	1144	+	func (x *JobCache) ProtoReflect() protoreflect.Message {
	1145	+	mi := &file_ermite_runner_proto_msgTypes[6]
	1146	+	if x != nil {
	1147	+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	1148	+	if ms.LoadMessageInfo() == nil {
	1149	+	ms.StoreMessageInfo(mi)
	1150	+	}
	1151	+	return ms
	1152	+	}
	1153	+	return mi.MessageOf(x)
	1154	+	}
	1155	+
	1156	+	// Deprecated: Use JobCache.ProtoReflect.Descriptor instead.
	1157	+	func (*JobCache) Descriptor() ([]byte, []int) {
	1158	+	return file_ermite_runner_proto_rawDescGZIP(), []int{6}
	1159	+	}
	1160	+
	1161	+	func (x *JobCache) GetRepository() string {
	1162	+	if x != nil {
	1163	+	return x.Repository
	1164	+	}
	1165	+	return ""
	1166	+	}
	1167	+
	1168	+	func (x *JobCache) GetWriteRef() string {
	1169	+	if x != nil {
	1170	+	return x.WriteRef
	1171	+	}
	1172	+	return ""
	1173	+	}
	1174	+
	1175	+	func (x *JobCache) GetReadRefs() []string {
	1176	+	if x != nil {
	1177	+	return x.ReadRefs
	1178	+	}
	1179	+	return nil
	1180	+	}
	1181	+
969	1182		// UpdateJobRequest reports the steps of a running job.
970	1183		type UpdateJobRequest struct {
971	1184		state protoimpl.MessageState `protogen:"open.v1"`

@@ -990,7 +1203,7 @@ type UpdateJobRequest struct {
990	1203
991	1204		func (x *UpdateJobRequest) Reset() {
992	1205		*x = UpdateJobRequest{}
993		-	mi := &file_ermite_runner_proto_msgTypes[5]
	1206	+	mi := &file_ermite_runner_proto_msgTypes[7]
994	1207		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
995	1208		ms.StoreMessageInfo(mi)
996	1209		}

@@ -1002,7 +1215,7 @@ func (x *UpdateJobRequest) String() string {
1002	1215		func (*UpdateJobRequest) ProtoMessage() {}
1003	1216
1004	1217		func (x *UpdateJobRequest) ProtoReflect() protoreflect.Message {
1005		-	mi := &file_ermite_runner_proto_msgTypes[5]
	1218	+	mi := &file_ermite_runner_proto_msgTypes[7]
1006	1219		if x != nil {
1007	1220		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1008	1221		if ms.LoadMessageInfo() == nil {

@@ -1015,7 +1228,7 @@ func (x *UpdateJobRequest) ProtoReflect() protoreflect.Message {
1015	1228
1016	1229		// Deprecated: Use UpdateJobRequest.ProtoReflect.Descriptor instead.
1017	1230		func (*UpdateJobRequest) Descriptor() ([]byte, []int) {
1018		-	return file_ermite_runner_proto_rawDescGZIP(), []int{5}
	1231	+	return file_ermite_runner_proto_rawDescGZIP(), []int{7}
1019	1232		}
1020	1233
1021	1234		func (x *UpdateJobRequest) GetJobId() string {

@@ -1075,7 +1288,7 @@ type StepUpdate struct {
1075	1288
1076	1289		func (x *StepUpdate) Reset() {
1077	1290		*x = StepUpdate{}
1078		-	mi := &file_ermite_runner_proto_msgTypes[6]
	1291	+	mi := &file_ermite_runner_proto_msgTypes[8]
1079	1292		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1080	1293		ms.StoreMessageInfo(mi)
1081	1294		}

@@ -1087,7 +1300,7 @@ func (x *StepUpdate) String() string {
1087	1300		func (*StepUpdate) ProtoMessage() {}
1088	1301
1089	1302		func (x *StepUpdate) ProtoReflect() protoreflect.Message {
1090		-	mi := &file_ermite_runner_proto_msgTypes[6]
	1303	+	mi := &file_ermite_runner_proto_msgTypes[8]
1091	1304		if x != nil {
1092	1305		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1093	1306		if ms.LoadMessageInfo() == nil {

@@ -1100,7 +1313,7 @@ func (x *StepUpdate) ProtoReflect() protoreflect.Message {
1100	1313
1101	1314		// Deprecated: Use StepUpdate.ProtoReflect.Descriptor instead.
1102	1315		func (*StepUpdate) Descriptor() ([]byte, []int) {
1103		-	return file_ermite_runner_proto_rawDescGZIP(), []int{6}
	1316	+	return file_ermite_runner_proto_rawDescGZIP(), []int{8}
1104	1317		}
1105	1318
1106	1319		func (x *StepUpdate) GetNumber() int32 {

@@ -1161,7 +1374,7 @@ type UpdateJobResponse struct {
1161	1374
1162	1375		func (x *UpdateJobResponse) Reset() {
1163	1376		*x = UpdateJobResponse{}
1164		-	mi := &file_ermite_runner_proto_msgTypes[7]
	1377	+	mi := &file_ermite_runner_proto_msgTypes[9]
1165	1378		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1166	1379		ms.StoreMessageInfo(mi)
1167	1380		}

@@ -1173,7 +1386,7 @@ func (x *UpdateJobResponse) String() string {
1173	1386		func (*UpdateJobResponse) ProtoMessage() {}
1174	1387
1175	1388		func (x *UpdateJobResponse) ProtoReflect() protoreflect.Message {
1176		-	mi := &file_ermite_runner_proto_msgTypes[7]
	1389	+	mi := &file_ermite_runner_proto_msgTypes[9]
1177	1390		if x != nil {
1178	1391		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1179	1392		if ms.LoadMessageInfo() == nil {

@@ -1186,7 +1399,7 @@ func (x *UpdateJobResponse) ProtoReflect() protoreflect.Message {
1186	1399
1187	1400		// Deprecated: Use UpdateJobResponse.ProtoReflect.Descriptor instead.
1188	1401		func (*UpdateJobResponse) Descriptor() ([]byte, []int) {
1189		-	return file_ermite_runner_proto_rawDescGZIP(), []int{7}
	1402	+	return file_ermite_runner_proto_rawDescGZIP(), []int{9}
1190	1403		}
1191	1404
1192	1405		// CompleteJobRequest ends a job.

@@ -1205,7 +1418,10 @@ type CompleteJobRequest struct {
1205	1418		// are invalid_argument. Each value is at most 1 MiB, and all names and
1206	1419		// values together at most 1 MiB (1,048,576 bytes); beyond that the whole call
1207	1420		// is rejected with invalid_argument and the runner reports the failure of
1208		-	// the job without outputs, with a line in the log.
	1421	+	// the job without outputs, with a line in the log. The runner leaves out an
	1422	+	// output whose value its masker would change, with the warning "Skip output
	1423	+	// '<name>' since it may contain secret." (as GitHub's runner), so no secret
	1424	+	// reaches the server through outputs.
1209	1425		Outputs map[string]string `protobuf:"bytes,3,rep,name=outputs,proto3" json:"outputs,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
1210	1426		// RunnerShutdown is true when the runner ends the job because it was told to
1211	1427		// stop (service stopped, signal). Only allowed with CI_CONCLUSION_CANCELLED.

@@ -1228,7 +1444,7 @@ type CompleteJobRequest struct {
1228	1444
1229	1445		func (x *CompleteJobRequest) Reset() {
1230	1446		*x = CompleteJobRequest{}
1231		-	mi := &file_ermite_runner_proto_msgTypes[8]
	1447	+	mi := &file_ermite_runner_proto_msgTypes[10]
1232	1448		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1233	1449		ms.StoreMessageInfo(mi)
1234	1450		}

@@ -1240,7 +1456,7 @@ func (x *CompleteJobRequest) String() string {
1240	1456		func (*CompleteJobRequest) ProtoMessage() {}
1241	1457
1242	1458		func (x *CompleteJobRequest) ProtoReflect() protoreflect.Message {
1243		-	mi := &file_ermite_runner_proto_msgTypes[8]
	1459	+	mi := &file_ermite_runner_proto_msgTypes[10]
1244	1460		if x != nil {
1245	1461		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1246	1462		if ms.LoadMessageInfo() == nil {

@@ -1253,7 +1469,7 @@ func (x *CompleteJobRequest) ProtoReflect() protoreflect.Message {
1253	1469
1254	1470		// Deprecated: Use CompleteJobRequest.ProtoReflect.Descriptor instead.
1255	1471		func (*CompleteJobRequest) Descriptor() ([]byte, []int) {
1256		-	return file_ermite_runner_proto_rawDescGZIP(), []int{8}
	1472	+	return file_ermite_runner_proto_rawDescGZIP(), []int{10}
1257	1473		}
1258	1474
1259	1475		func (x *CompleteJobRequest) GetJobId() string {

@@ -1316,7 +1532,7 @@ type CompleteJobResponse struct {
1316	1532
1317	1533		func (x *CompleteJobResponse) Reset() {
1318	1534		*x = CompleteJobResponse{}
1319		-	mi := &file_ermite_runner_proto_msgTypes[9]
	1535	+	mi := &file_ermite_runner_proto_msgTypes[11]
1320	1536		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1321	1537		ms.StoreMessageInfo(mi)
1322	1538		}

@@ -1328,7 +1544,7 @@ func (x *CompleteJobResponse) String() string {
1328	1544		func (*CompleteJobResponse) ProtoMessage() {}
1329	1545
1330	1546		func (x *CompleteJobResponse) ProtoReflect() protoreflect.Message {
1331		-	mi := &file_ermite_runner_proto_msgTypes[9]
	1547	+	mi := &file_ermite_runner_proto_msgTypes[11]
1332	1548		if x != nil {
1333	1549		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1334	1550		if ms.LoadMessageInfo() == nil {

@@ -1341,7 +1557,7 @@ func (x *CompleteJobResponse) ProtoReflect() protoreflect.Message {
1341	1557
1342	1558		// Deprecated: Use CompleteJobResponse.ProtoReflect.Descriptor instead.
1343	1559		func (*CompleteJobResponse) Descriptor() ([]byte, []int) {
1344		-	return file_ermite_runner_proto_rawDescGZIP(), []int{9}
	1560	+	return file_ermite_runner_proto_rawDescGZIP(), []int{11}
1345	1561		}
1346	1562
1347	1563		func (x *CompleteJobResponse) GetConclusion() CiConclusion {

@@ -1381,7 +1597,7 @@ type JobEnded struct {
1381	1597
1382	1598		func (x *JobEnded) Reset() {
1383	1599		*x = JobEnded{}
1384		-	mi := &file_ermite_runner_proto_msgTypes[10]
	1600	+	mi := &file_ermite_runner_proto_msgTypes[12]
1385	1601		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1386	1602		ms.StoreMessageInfo(mi)
1387	1603		}

@@ -1393,7 +1609,7 @@ func (x *JobEnded) String() string {
1393	1609		func (*JobEnded) ProtoMessage() {}
1394	1610
1395	1611		func (x *JobEnded) ProtoReflect() protoreflect.Message {
1396		-	mi := &file_ermite_runner_proto_msgTypes[10]
	1612	+	mi := &file_ermite_runner_proto_msgTypes[12]
1397	1613		if x != nil {
1398	1614		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1399	1615		if ms.LoadMessageInfo() == nil {

@@ -1406,7 +1622,7 @@ func (x *JobEnded) ProtoReflect() protoreflect.Message {
1406	1622
1407	1623		// Deprecated: Use JobEnded.ProtoReflect.Descriptor instead.
1408	1624		func (*JobEnded) Descriptor() ([]byte, []int) {
1409		-	return file_ermite_runner_proto_rawDescGZIP(), []int{10}
	1625	+	return file_ermite_runner_proto_rawDescGZIP(), []int{12}
1410	1626		}
1411	1627
1412	1628		func (x *JobEnded) GetConclusion() CiConclusion {

@@ -1445,7 +1661,7 @@ type AppendLogRequest struct {
1445	1661
1446	1662		func (x *AppendLogRequest) Reset() {
1447	1663		*x = AppendLogRequest{}
1448		-	mi := &file_ermite_runner_proto_msgTypes[11]
	1664	+	mi := &file_ermite_runner_proto_msgTypes[13]
1449	1665		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1450	1666		ms.StoreMessageInfo(mi)
1451	1667		}

@@ -1457,7 +1673,7 @@ func (x *AppendLogRequest) String() string {
1457	1673		func (*AppendLogRequest) ProtoMessage() {}
1458	1674
1459	1675		func (x *AppendLogRequest) ProtoReflect() protoreflect.Message {
1460		-	mi := &file_ermite_runner_proto_msgTypes[11]
	1676	+	mi := &file_ermite_runner_proto_msgTypes[13]
1461	1677		if x != nil {
1462	1678		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1463	1679		if ms.LoadMessageInfo() == nil {

@@ -1470,7 +1686,7 @@ func (x *AppendLogRequest) ProtoReflect() protoreflect.Message {
1470	1686
1471	1687		// Deprecated: Use AppendLogRequest.ProtoReflect.Descriptor instead.
1472	1688		func (*AppendLogRequest) Descriptor() ([]byte, []int) {
1473		-	return file_ermite_runner_proto_rawDescGZIP(), []int{11}
	1689	+	return file_ermite_runner_proto_rawDescGZIP(), []int{13}
1474	1690		}
1475	1691
1476	1692		func (x *AppendLogRequest) GetJobId() string {

@@ -1527,7 +1743,7 @@ type LogLine struct {
1527	1743
1528	1744		func (x *LogLine) Reset() {
1529	1745		*x = LogLine{}
1530		-	mi := &file_ermite_runner_proto_msgTypes[12]
	1746	+	mi := &file_ermite_runner_proto_msgTypes[14]
1531	1747		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1532	1748		ms.StoreMessageInfo(mi)
1533	1749		}

@@ -1539,7 +1755,7 @@ func (x *LogLine) String() string {
1539	1755		func (*LogLine) ProtoMessage() {}
1540	1756
1541	1757		func (x *LogLine) ProtoReflect() protoreflect.Message {
1542		-	mi := &file_ermite_runner_proto_msgTypes[12]
	1758	+	mi := &file_ermite_runner_proto_msgTypes[14]
1543	1759		if x != nil {
1544	1760		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1545	1761		if ms.LoadMessageInfo() == nil {

@@ -1552,7 +1768,7 @@ func (x *LogLine) ProtoReflect() protoreflect.Message {
1552	1768
1553	1769		// Deprecated: Use LogLine.ProtoReflect.Descriptor instead.
1554	1770		func (*LogLine) Descriptor() ([]byte, []int) {
1555		-	return file_ermite_runner_proto_rawDescGZIP(), []int{12}
	1771	+	return file_ermite_runner_proto_rawDescGZIP(), []int{14}
1556	1772		}
1557	1773
1558	1774		func (x LogLine) GetTime() timestamppb.Timestamp {

@@ -1588,7 +1804,7 @@ type AppendLogResponse struct {
1588	1804
1589	1805		func (x *AppendLogResponse) Reset() {
1590	1806		*x = AppendLogResponse{}
1591		-	mi := &file_ermite_runner_proto_msgTypes[13]
	1807	+	mi := &file_ermite_runner_proto_msgTypes[15]
1592	1808		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1593	1809		ms.StoreMessageInfo(mi)
1594	1810		}

@@ -1600,7 +1816,7 @@ func (x *AppendLogResponse) String() string {
1600	1816		func (*AppendLogResponse) ProtoMessage() {}
1601	1817
1602	1818		func (x *AppendLogResponse) ProtoReflect() protoreflect.Message {
1603		-	mi := &file_ermite_runner_proto_msgTypes[13]
	1819	+	mi := &file_ermite_runner_proto_msgTypes[15]
1604	1820		if x != nil {
1605	1821		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1606	1822		if ms.LoadMessageInfo() == nil {

@@ -1613,7 +1829,7 @@ func (x *AppendLogResponse) ProtoReflect() protoreflect.Message {
1613	1829
1614	1830		// Deprecated: Use AppendLogResponse.ProtoReflect.Descriptor instead.
1615	1831		func (*AppendLogResponse) Descriptor() ([]byte, []int) {
1616		-	return file_ermite_runner_proto_rawDescGZIP(), []int{13}
	1832	+	return file_ermite_runner_proto_rawDescGZIP(), []int{15}
1617	1833		}
1618	1834
1619	1835		func (x *AppendLogResponse) GetNextOffset() int64 {

@@ -1634,7 +1850,7 @@ type HeartbeatRequest struct {
1634	1850
1635	1851		func (x *HeartbeatRequest) Reset() {
1636	1852		*x = HeartbeatRequest{}
1637		-	mi := &file_ermite_runner_proto_msgTypes[14]
	1853	+	mi := &file_ermite_runner_proto_msgTypes[16]
1638	1854		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1639	1855		ms.StoreMessageInfo(mi)
1640	1856		}

@@ -1646,7 +1862,7 @@ func (x *HeartbeatRequest) String() string {
1646	1862		func (*HeartbeatRequest) ProtoMessage() {}
1647	1863
1648	1864		func (x *HeartbeatRequest) ProtoReflect() protoreflect.Message {
1649		-	mi := &file_ermite_runner_proto_msgTypes[14]
	1865	+	mi := &file_ermite_runner_proto_msgTypes[16]
1650	1866		if x != nil {
1651	1867		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1652	1868		if ms.LoadMessageInfo() == nil {

@@ -1659,7 +1875,7 @@ func (x *HeartbeatRequest) ProtoReflect() protoreflect.Message {
1659	1875
1660	1876		// Deprecated: Use HeartbeatRequest.ProtoReflect.Descriptor instead.
1661	1877		func (*HeartbeatRequest) Descriptor() ([]byte, []int) {
1662		-	return file_ermite_runner_proto_rawDescGZIP(), []int{14}
	1878	+	return file_ermite_runner_proto_rawDescGZIP(), []int{16}
1663	1879		}
1664	1880
1665	1881		func (x *HeartbeatRequest) GetJobId() string {

@@ -1678,7 +1894,7 @@ type HeartbeatResponse struct {
1678	1894
1679	1895		func (x *HeartbeatResponse) Reset() {
1680	1896		*x = HeartbeatResponse{}
1681		-	mi := &file_ermite_runner_proto_msgTypes[15]
	1897	+	mi := &file_ermite_runner_proto_msgTypes[17]
1682	1898		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1683	1899		ms.StoreMessageInfo(mi)
1684	1900		}

@@ -1690,7 +1906,7 @@ func (x *HeartbeatResponse) String() string {
1690	1906		func (*HeartbeatResponse) ProtoMessage() {}
1691	1907
1692	1908		func (x *HeartbeatResponse) ProtoReflect() protoreflect.Message {
1693		-	mi := &file_ermite_runner_proto_msgTypes[15]
	1909	+	mi := &file_ermite_runner_proto_msgTypes[17]
1694	1910		if x != nil {
1695	1911		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1696	1912		if ms.LoadMessageInfo() == nil {

@@ -1703,7 +1919,7 @@ func (x *HeartbeatResponse) ProtoReflect() protoreflect.Message {
1703	1919
1704	1920		// Deprecated: Use HeartbeatResponse.ProtoReflect.Descriptor instead.
1705	1921		func (*HeartbeatResponse) Descriptor() ([]byte, []int) {
1706		-	return file_ermite_runner_proto_rawDescGZIP(), []int{15}
	1922	+	return file_ermite_runner_proto_rawDescGZIP(), []int{17}
1707	1923		}
1708	1924
1709	1925		// WatchJobRequest names the job to watch.

@@ -1717,7 +1933,7 @@ type WatchJobRequest struct {
1717	1933
1718	1934		func (x *WatchJobRequest) Reset() {
1719	1935		*x = WatchJobRequest{}
1720		-	mi := &file_ermite_runner_proto_msgTypes[16]
	1936	+	mi := &file_ermite_runner_proto_msgTypes[18]
1721	1937		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1722	1938		ms.StoreMessageInfo(mi)
1723	1939		}

@@ -1729,7 +1945,7 @@ func (x *WatchJobRequest) String() string {
1729	1945		func (*WatchJobRequest) ProtoMessage() {}
1730	1946
1731	1947		func (x *WatchJobRequest) ProtoReflect() protoreflect.Message {
1732		-	mi := &file_ermite_runner_proto_msgTypes[16]
	1948	+	mi := &file_ermite_runner_proto_msgTypes[18]
1733	1949		if x != nil {
1734	1950		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1735	1951		if ms.LoadMessageInfo() == nil {

@@ -1742,7 +1958,7 @@ func (x *WatchJobRequest) ProtoReflect() protoreflect.Message {
1742	1958
1743	1959		// Deprecated: Use WatchJobRequest.ProtoReflect.Descriptor instead.
1744	1960		func (*WatchJobRequest) Descriptor() ([]byte, []int) {
1745		-	return file_ermite_runner_proto_rawDescGZIP(), []int{16}
	1961	+	return file_ermite_runner_proto_rawDescGZIP(), []int{18}
1746	1962		}
1747	1963
1748	1964		func (x *WatchJobRequest) GetJobId() string {

@@ -1770,7 +1986,7 @@ type WatchJobResponse struct {
1770	1986
1771	1987		func (x *WatchJobResponse) Reset() {
1772	1988		*x = WatchJobResponse{}
1773		-	mi := &file_ermite_runner_proto_msgTypes[17]
	1989	+	mi := &file_ermite_runner_proto_msgTypes[19]
1774	1990		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1775	1991		ms.StoreMessageInfo(mi)
1776	1992		}

@@ -1782,7 +1998,7 @@ func (x *WatchJobResponse) String() string {
1782	1998		func (*WatchJobResponse) ProtoMessage() {}
1783	1999
1784	2000		func (x *WatchJobResponse) ProtoReflect() protoreflect.Message {
1785		-	mi := &file_ermite_runner_proto_msgTypes[17]
	2001	+	mi := &file_ermite_runner_proto_msgTypes[19]
1786	2002		if x != nil {
1787	2003		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1788	2004		if ms.LoadMessageInfo() == nil {

@@ -1795,7 +2011,7 @@ func (x *WatchJobResponse) ProtoReflect() protoreflect.Message {
1795	2011
1796	2012		// Deprecated: Use WatchJobResponse.ProtoReflect.Descriptor instead.
1797	2013		func (*WatchJobResponse) Descriptor() ([]byte, []int) {
1798		-	return file_ermite_runner_proto_rawDescGZIP(), []int{17}
	2014	+	return file_ermite_runner_proto_rawDescGZIP(), []int{19}
1799	2015		}
1800	2016
1801	2017		func (x *WatchJobResponse) GetMsg() isWatchJobResponse_Msg {

@@ -1867,7 +2083,7 @@ type Keepalive struct {
1867	2083
1868	2084		func (x *Keepalive) Reset() {
1869	2085		*x = Keepalive{}
1870		-	mi := &file_ermite_runner_proto_msgTypes[18]
	2086	+	mi := &file_ermite_runner_proto_msgTypes[20]
1871	2087		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1872	2088		ms.StoreMessageInfo(mi)
1873	2089		}

@@ -1879,7 +2095,7 @@ func (x *Keepalive) String() string {
1879	2095		func (*Keepalive) ProtoMessage() {}
1880	2096
1881	2097		func (x *Keepalive) ProtoReflect() protoreflect.Message {
1882		-	mi := &file_ermite_runner_proto_msgTypes[18]
	2098	+	mi := &file_ermite_runner_proto_msgTypes[20]
1883	2099		if x != nil {
1884	2100		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1885	2101		if ms.LoadMessageInfo() == nil {

@@ -1892,7 +2108,7 @@ func (x *Keepalive) ProtoReflect() protoreflect.Message {
1892	2108
1893	2109		// Deprecated: Use Keepalive.ProtoReflect.Descriptor instead.
1894	2110		func (*Keepalive) Descriptor() ([]byte, []int) {
1895		-	return file_ermite_runner_proto_rawDescGZIP(), []int{18}
	2111	+	return file_ermite_runner_proto_rawDescGZIP(), []int{20}
1896	2112		}
1897	2113
1898	2114		// CancelRequest asks the runner to stop a job.

@@ -1913,7 +2129,7 @@ type CancelRequest struct {
1913	2129
1914	2130		func (x *CancelRequest) Reset() {
1915	2131		*x = CancelRequest{}
1916		-	mi := &file_ermite_runner_proto_msgTypes[19]
	2132	+	mi := &file_ermite_runner_proto_msgTypes[21]
1917	2133		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1918	2134		ms.StoreMessageInfo(mi)
1919	2135		}

@@ -1925,7 +2141,7 @@ func (x *CancelRequest) String() string {
1925	2141		func (*CancelRequest) ProtoMessage() {}
1926	2142
1927	2143		func (x *CancelRequest) ProtoReflect() protoreflect.Message {
1928		-	mi := &file_ermite_runner_proto_msgTypes[19]
	2144	+	mi := &file_ermite_runner_proto_msgTypes[21]
1929	2145		if x != nil {
1930	2146		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1931	2147		if ms.LoadMessageInfo() == nil {

@@ -1938,7 +2154,7 @@ func (x *CancelRequest) ProtoReflect() protoreflect.Message {
1938	2154
1939	2155		// Deprecated: Use CancelRequest.ProtoReflect.Descriptor instead.
1940	2156		func (*CancelRequest) Descriptor() ([]byte, []int) {
1941		-	return file_ermite_runner_proto_rawDescGZIP(), []int{19}
	2157	+	return file_ermite_runner_proto_rawDescGZIP(), []int{21}
1942	2158		}
1943	2159
1944	2160		func (x *CancelRequest) GetReason() CancelReason {

@@ -2004,7 +2220,7 @@ type Annotation struct {
2004	2220
2005	2221		func (x *Annotation) Reset() {
2006	2222		*x = Annotation{}
2007		-	mi := &file_ermite_runner_proto_msgTypes[20]
	2223	+	mi := &file_ermite_runner_proto_msgTypes[22]
2008	2224		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2009	2225		ms.StoreMessageInfo(mi)
2010	2226		}

@@ -2016,7 +2232,7 @@ func (x *Annotation) String() string {
2016	2232		func (*Annotation) ProtoMessage() {}
2017	2233
2018	2234		func (x *Annotation) ProtoReflect() protoreflect.Message {
2019		-	mi := &file_ermite_runner_proto_msgTypes[20]
	2235	+	mi := &file_ermite_runner_proto_msgTypes[22]
2020	2236		if x != nil {
2021	2237		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2022	2238		if ms.LoadMessageInfo() == nil {

@@ -2029,7 +2245,7 @@ func (x *Annotation) ProtoReflect() protoreflect.Message {
2029	2245
2030	2246		// Deprecated: Use Annotation.ProtoReflect.Descriptor instead.
2031	2247		func (*Annotation) Descriptor() ([]byte, []int) {
2032		-	return file_ermite_runner_proto_rawDescGZIP(), []int{20}
	2248	+	return file_ermite_runner_proto_rawDescGZIP(), []int{22}
2033	2249		}
2034	2250
2035	2251		func (x *Annotation) GetLevel() AnnotationLevel {

@@ -2107,7 +2323,7 @@ type ActionRef struct {
2107	2323
2108	2324		func (x *ActionRef) Reset() {
2109	2325		*x = ActionRef{}
2110		-	mi := &file_ermite_runner_proto_msgTypes[21]
	2326	+	mi := &file_ermite_runner_proto_msgTypes[23]
2111	2327		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2112	2328		ms.StoreMessageInfo(mi)
2113	2329		}

@@ -2119,7 +2335,7 @@ func (x *ActionRef) String() string {
2119	2335		func (*ActionRef) ProtoMessage() {}
2120	2336
2121	2337		func (x *ActionRef) ProtoReflect() protoreflect.Message {
2122		-	mi := &file_ermite_runner_proto_msgTypes[21]
	2338	+	mi := &file_ermite_runner_proto_msgTypes[23]
2123	2339		if x != nil {
2124	2340		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2125	2341		if ms.LoadMessageInfo() == nil {

@@ -2132,7 +2348,7 @@ func (x *ActionRef) ProtoReflect() protoreflect.Message {
2132	2348
2133	2349		// Deprecated: Use ActionRef.ProtoReflect.Descriptor instead.
2134	2350		func (*ActionRef) Descriptor() ([]byte, []int) {
2135		-	return file_ermite_runner_proto_rawDescGZIP(), []int{21}
	2351	+	return file_ermite_runner_proto_rawDescGZIP(), []int{23}
2136	2352		}
2137	2353
2138	2354		func (x *ActionRef) GetUses() string {

@@ -2156,7 +2372,7 @@ type ResolveActionsRequest struct {
2156	2372
2157	2373		func (x *ResolveActionsRequest) Reset() {
2158	2374		*x = ResolveActionsRequest{}
2159		-	mi := &file_ermite_runner_proto_msgTypes[22]
	2375	+	mi := &file_ermite_runner_proto_msgTypes[24]
2160	2376		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2161	2377		ms.StoreMessageInfo(mi)
2162	2378		}

@@ -2168,7 +2384,7 @@ func (x *ResolveActionsRequest) String() string {
2168	2384		func (*ResolveActionsRequest) ProtoMessage() {}
2169	2385
2170	2386		func (x *ResolveActionsRequest) ProtoReflect() protoreflect.Message {
2171		-	mi := &file_ermite_runner_proto_msgTypes[22]
	2387	+	mi := &file_ermite_runner_proto_msgTypes[24]
2172	2388		if x != nil {
2173	2389		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2174	2390		if ms.LoadMessageInfo() == nil {

@@ -2181,7 +2397,7 @@ func (x *ResolveActionsRequest) ProtoReflect() protoreflect.Message {
2181	2397
2182	2398		// Deprecated: Use ResolveActionsRequest.ProtoReflect.Descriptor instead.
2183	2399		func (*ResolveActionsRequest) Descriptor() ([]byte, []int) {
2184		-	return file_ermite_runner_proto_rawDescGZIP(), []int{22}
	2400	+	return file_ermite_runner_proto_rawDescGZIP(), []int{24}
2185	2401		}
2186	2402
2187	2403		func (x *ResolveActionsRequest) GetJobId() string {

@@ -2209,7 +2425,7 @@ type ResolveActionsResponse struct {
2209	2425
2210	2426		func (x *ResolveActionsResponse) Reset() {
2211	2427		*x = ResolveActionsResponse{}
2212		-	mi := &file_ermite_runner_proto_msgTypes[23]
	2428	+	mi := &file_ermite_runner_proto_msgTypes[25]
2213	2429		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2214	2430		ms.StoreMessageInfo(mi)
2215	2431		}

@@ -2221,7 +2437,7 @@ func (x *ResolveActionsResponse) String() string {
2221	2437		func (*ResolveActionsResponse) ProtoMessage() {}
2222	2438
2223	2439		func (x *ResolveActionsResponse) ProtoReflect() protoreflect.Message {
2224		-	mi := &file_ermite_runner_proto_msgTypes[23]
	2440	+	mi := &file_ermite_runner_proto_msgTypes[25]
2225	2441		if x != nil {
2226	2442		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2227	2443		if ms.LoadMessageInfo() == nil {

@@ -2234,7 +2450,7 @@ func (x *ResolveActionsResponse) ProtoReflect() protoreflect.Message {
2234	2450
2235	2451		// Deprecated: Use ResolveActionsResponse.ProtoReflect.Descriptor instead.
2236	2452		func (*ResolveActionsResponse) Descriptor() ([]byte, []int) {
2237		-	return file_ermite_runner_proto_rawDescGZIP(), []int{23}
	2453	+	return file_ermite_runner_proto_rawDescGZIP(), []int{25}
2238	2454		}
2239	2455
2240	2456		func (x ResolveActionsResponse) GetActions() []ResolvedAction {

@@ -2289,7 +2505,7 @@ type ResolvedAction struct {
2289	2505
2290	2506		func (x *ResolvedAction) Reset() {
2291	2507		*x = ResolvedAction{}
2292		-	mi := &file_ermite_runner_proto_msgTypes[24]
	2508	+	mi := &file_ermite_runner_proto_msgTypes[26]
2293	2509		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2294	2510		ms.StoreMessageInfo(mi)
2295	2511		}

@@ -2301,7 +2517,7 @@ func (x *ResolvedAction) String() string {
2301	2517		func (*ResolvedAction) ProtoMessage() {}
2302	2518
2303	2519		func (x *ResolvedAction) ProtoReflect() protoreflect.Message {
2304		-	mi := &file_ermite_runner_proto_msgTypes[24]
	2520	+	mi := &file_ermite_runner_proto_msgTypes[26]
2305	2521		if x != nil {
2306	2522		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2307	2523		if ms.LoadMessageInfo() == nil {

@@ -2314,7 +2530,7 @@ func (x *ResolvedAction) ProtoReflect() protoreflect.Message {
2314	2530
2315	2531		// Deprecated: Use ResolvedAction.ProtoReflect.Descriptor instead.
2316	2532		func (*ResolvedAction) Descriptor() ([]byte, []int) {
2317		-	return file_ermite_runner_proto_rawDescGZIP(), []int{24}
	2533	+	return file_ermite_runner_proto_rawDescGZIP(), []int{26}
2318	2534		}
2319	2535
2320	2536		func (x *ResolvedAction) GetRef() string {

@@ -2390,7 +2606,7 @@ type UploadSummaryRequest struct {
2390	2606
2391	2607		func (x *UploadSummaryRequest) Reset() {
2392	2608		*x = UploadSummaryRequest{}
2393		-	mi := &file_ermite_runner_proto_msgTypes[25]
	2609	+	mi := &file_ermite_runner_proto_msgTypes[27]
2394	2610		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2395	2611		ms.StoreMessageInfo(mi)
2396	2612		}

@@ -2402,7 +2618,7 @@ func (x *UploadSummaryRequest) String() string {
2402	2618		func (*UploadSummaryRequest) ProtoMessage() {}
2403	2619
2404	2620		func (x *UploadSummaryRequest) ProtoReflect() protoreflect.Message {
2405		-	mi := &file_ermite_runner_proto_msgTypes[25]
	2621	+	mi := &file_ermite_runner_proto_msgTypes[27]
2406	2622		if x != nil {
2407	2623		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2408	2624		if ms.LoadMessageInfo() == nil {

@@ -2415,7 +2631,7 @@ func (x *UploadSummaryRequest) ProtoReflect() protoreflect.Message {
2415	2631
2416	2632		// Deprecated: Use UploadSummaryRequest.ProtoReflect.Descriptor instead.
2417	2633		func (*UploadSummaryRequest) Descriptor() ([]byte, []int) {
2418		-	return file_ermite_runner_proto_rawDescGZIP(), []int{25}
	2634	+	return file_ermite_runner_proto_rawDescGZIP(), []int{27}
2419	2635		}
2420	2636
2421	2637		func (x *UploadSummaryRequest) GetJobId() string {

@@ -2448,7 +2664,7 @@ type UploadSummaryResponse struct {
2448	2664
2449	2665		func (x *UploadSummaryResponse) Reset() {
2450	2666		*x = UploadSummaryResponse{}
2451		-	mi := &file_ermite_runner_proto_msgTypes[26]
	2667	+	mi := &file_ermite_runner_proto_msgTypes[28]
2452	2668		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2453	2669		ms.StoreMessageInfo(mi)
2454	2670		}

@@ -2460,7 +2676,7 @@ func (x *UploadSummaryResponse) String() string {
2460	2676		func (*UploadSummaryResponse) ProtoMessage() {}
2461	2677
2462	2678		func (x *UploadSummaryResponse) ProtoReflect() protoreflect.Message {
2463		-	mi := &file_ermite_runner_proto_msgTypes[26]
	2679	+	mi := &file_ermite_runner_proto_msgTypes[28]
2464	2680		if x != nil {
2465	2681		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2466	2682		if ms.LoadMessageInfo() == nil {

@@ -2473,7 +2689,7 @@ func (x *UploadSummaryResponse) ProtoReflect() protoreflect.Message {
2473	2689
2474	2690		// Deprecated: Use UploadSummaryResponse.ProtoReflect.Descriptor instead.
2475	2691		func (*UploadSummaryResponse) Descriptor() ([]byte, []int) {
2476		-	return file_ermite_runner_proto_rawDescGZIP(), []int{26}
	2692	+	return file_ermite_runner_proto_rawDescGZIP(), []int{28}
2477	2693		}
2478	2694
2479	2695		var File_ermite_runner_proto protoreflect.FileDescriptor

@@ -2498,7 +2714,7 @@ const file_ermite_runner_proto_rawDesc = "" +
2498	2714		"\x10FetchJobResponse\x12\x1d\n" +
2499	2715		"\x03job\x18\x01 \x01(\v2\v.ermite.JobR\x03job\x12:\n" +
2500	2716		"\vretry_after\x18\x02 \x01(\v2\x19.google.protobuf.DurationR\n" +
2501		-	"retryAfter\"\x9d\x03\n" +
	2717	+	"retryAfter\"\x8f\x06\n" +
2502	2718		"\x03Job\x12\x15\n" +
2503	2719		"\x06job_id\x18\x01 \x01(\tR\x05jobId\x12\x15\n" +
2504	2720		"\x06run_id\x18\x02 \x01(\x03R\x05runId\x12\x18\n" +

@@ -2515,7 +2731,30 @@ const file_ermite_runner_proto_rawDesc = "" +
2515	2731		"\x04repo\x18\f \x01(\tR\x04repo\x12\x10\n" +
2516	2732		"\x03sha\x18\r \x01(\tR\x03sha\x12\x10\n" +
2517	2733		"\x03ref\x18\x0e \x01(\tR\x03ref\x12!\n" +
2518		-	"\fgithub_token\x18\x0f \x01(\tR\vgithubToken\"\x89\x01\n" +
	2734	+	"\fgithub_token\x18\x0f \x01(\tR\vgithubToken\x122\n" +
	2735	+	"\asecrets\x18\x10 \x03(\v2\x18.ermite.Job.SecretsEntryR\asecrets\x12)\n" +
	2736	+	"\x04vars\x18\x11 \x03(\v2\x15.ermite.Job.VarsEntryR\x04vars\x12 \n" +
	2737	+	"\venvironment\x18\x12 \x01(\tR\venvironment\x128\n" +
	2738	+	"\vpermissions\x18\x13 \x01(\v2\x16.ermite.JobPermissionsR\vpermissions\x12&\n" +
	2739	+	"\x05cache\x18\x14 \x01(\v2\x10.ermite.JobCacheR\x05cache\x12\x18\n" +
	2740	+	"\atrusted\x18\x15 \x01(\bR\atrusted\x1a:\n" +
	2741	+	"\fSecretsEntry\x12\x10\n" +
	2742	+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	2743	+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a7\n" +
	2744	+	"\tVarsEntry\x12\x10\n" +
	2745	+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	2746	+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x87\x01\n" +
	2747	+	"\x0eJobPermissions\x12:\n" +
	2748	+	"\x06levels\x18\x01 \x03(\v2\".ermite.JobPermissions.LevelsEntryR\x06levels\x1a9\n" +
	2749	+	"\vLevelsEntry\x12\x10\n" +
	2750	+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	2751	+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"d\n" +
	2752	+	"\bJobCache\x12\x1e\n" +
	2753	+	"\n" +
	2754	+	"repository\x18\x01 \x01(\tR\n" +
	2755	+	"repository\x12\x1b\n" +
	2756	+	"\twrite_ref\x18\x02 \x01(\tR\bwriteRef\x12\x1b\n" +
	2757	+	"\tread_refs\x18\x03 \x03(\tR\breadRefs\"\x89\x01\n" +
2519	2758		"\x10UpdateJobRequest\x12\x15\n" +
2520	2759		"\x06job_id\x18\x01 \x01(\tR\x05jobId\x12(\n" +
2521	2760		"\x05steps\x18\x02 \x03(\v2\x12.ermite.StepUpdateR\x05steps\x124\n" +

@@ -2619,12 +2858,13 @@ const file_ermite_runner_proto_rawDesc = "" +
2619	2858		"\vstep_number\x18\x02 \x01(\x05R\n" +
2620	2859		"stepNumber\x12\x1a\n" +
2621	2860		"\bmarkdown\x18\x03 \x01(\tR\bmarkdown\"\x17\n" +
2622		-	"\x15UploadSummaryResponse*o\n" +
	2861	+	"\x15UploadSummaryResponse*\x86\x01\n" +
2623	2862		"\bCiStatus\x12\x19\n" +
2624	2863		"\x15CI_STATUS_UNSPECIFIED\x10\x00\x12\x14\n" +
2625	2864		"\x10CI_STATUS_QUEUED\x10\x01\x12\x19\n" +
2626	2865		"\x15CI_STATUS_IN_PROGRESS\x10\x02\x12\x17\n" +
2627		-	"\x13CI_STATUS_COMPLETED\x10\x03*\xf6\x01\n" +
	2866	+	"\x13CI_STATUS_COMPLETED\x10\x03\x12\x15\n" +
	2867	+	"\x11CI_STATUS_PENDING\x10\x04*\xf6\x01\n" +
2628	2868		"\fCiConclusion\x12\x1d\n" +
2629	2869		"\x19CI_CONCLUSION_UNSPECIFIED\x10\x00\x12\x19\n" +
2630	2870		"\x15CI_CONCLUSION_SUCCESS\x10\x01\x12\x19\n" +

@@ -2684,7 +2924,7 @@ func file_ermite_runner_proto_rawDescGZIP() []byte {
2684	2924		}
2685	2925
2686	2926		var file_ermite_runner_proto_enumTypes = make([]protoimpl.EnumInfo, 7)
2687		-	var file_ermite_runner_proto_msgTypes = make([]protoimpl.MessageInfo, 28)
	2927	+	var file_ermite_runner_proto_msgTypes = make([]protoimpl.MessageInfo, 33)
2688	2928		var file_ermite_runner_proto_goTypes = []any{
2689	2929		(CiStatus)(0), // 0: ermite.CiStatus
2690	2930		(CiConclusion)(0), // 1: ermite.CiConclusion

@@ -2698,83 +2938,93 @@ var file_ermite_runner_proto_goTypes = []any{
2698	2938		(*FetchJobRequest)(nil), // 9: ermite.FetchJobRequest
2699	2939		(*FetchJobResponse)(nil), // 10: ermite.FetchJobResponse
2700	2940		(*Job)(nil), // 11: ermite.Job
2701		-	(*UpdateJobRequest)(nil), // 12: ermite.UpdateJobRequest
2702		-	(*StepUpdate)(nil), // 13: ermite.StepUpdate
2703		-	(*UpdateJobResponse)(nil), // 14: ermite.UpdateJobResponse
2704		-	(*CompleteJobRequest)(nil), // 15: ermite.CompleteJobRequest
2705		-	(*CompleteJobResponse)(nil), // 16: ermite.CompleteJobResponse
2706		-	(*JobEnded)(nil), // 17: ermite.JobEnded
2707		-	(*AppendLogRequest)(nil), // 18: ermite.AppendLogRequest
2708		-	(*LogLine)(nil), // 19: ermite.LogLine
2709		-	(*AppendLogResponse)(nil), // 20: ermite.AppendLogResponse
2710		-	(*HeartbeatRequest)(nil), // 21: ermite.HeartbeatRequest
2711		-	(*HeartbeatResponse)(nil), // 22: ermite.HeartbeatResponse
2712		-	(*WatchJobRequest)(nil), // 23: ermite.WatchJobRequest
2713		-	(*WatchJobResponse)(nil), // 24: ermite.WatchJobResponse
2714		-	(*Keepalive)(nil), // 25: ermite.Keepalive
2715		-	(*CancelRequest)(nil), // 26: ermite.CancelRequest
2716		-	(*Annotation)(nil), // 27: ermite.Annotation
2717		-	(*ActionRef)(nil), // 28: ermite.ActionRef
2718		-	(*ResolveActionsRequest)(nil), // 29: ermite.ResolveActionsRequest
2719		-	(*ResolveActionsResponse)(nil), // 30: ermite.ResolveActionsResponse
2720		-	(*ResolvedAction)(nil), // 31: ermite.ResolvedAction
2721		-	(*UploadSummaryRequest)(nil), // 32: ermite.UploadSummaryRequest
2722		-	(*UploadSummaryResponse)(nil), // 33: ermite.UploadSummaryResponse
2723		-	nil, // 34: ermite.CompleteJobRequest.OutputsEntry
2724		-	(*durationpb.Duration)(nil), // 35: google.protobuf.Duration
2725		-	(*timestamppb.Timestamp)(nil), // 36: google.protobuf.Timestamp
	2941	+	(*JobPermissions)(nil), // 12: ermite.JobPermissions
	2942	+	(*JobCache)(nil), // 13: ermite.JobCache
	2943	+	(*UpdateJobRequest)(nil), // 14: ermite.UpdateJobRequest
	2944	+	(*StepUpdate)(nil), // 15: ermite.StepUpdate
	2945	+	(*UpdateJobResponse)(nil), // 16: ermite.UpdateJobResponse
	2946	+	(*CompleteJobRequest)(nil), // 17: ermite.CompleteJobRequest
	2947	+	(*CompleteJobResponse)(nil), // 18: ermite.CompleteJobResponse
	2948	+	(*JobEnded)(nil), // 19: ermite.JobEnded
	2949	+	(*AppendLogRequest)(nil), // 20: ermite.AppendLogRequest
	2950	+	(*LogLine)(nil), // 21: ermite.LogLine
	2951	+	(*AppendLogResponse)(nil), // 22: ermite.AppendLogResponse
	2952	+	(*HeartbeatRequest)(nil), // 23: ermite.HeartbeatRequest
	2953	+	(*HeartbeatResponse)(nil), // 24: ermite.HeartbeatResponse
	2954	+	(*WatchJobRequest)(nil), // 25: ermite.WatchJobRequest
	2955	+	(*WatchJobResponse)(nil), // 26: ermite.WatchJobResponse
	2956	+	(*Keepalive)(nil), // 27: ermite.Keepalive
	2957	+	(*CancelRequest)(nil), // 28: ermite.CancelRequest
	2958	+	(*Annotation)(nil), // 29: ermite.Annotation
	2959	+	(*ActionRef)(nil), // 30: ermite.ActionRef
	2960	+	(*ResolveActionsRequest)(nil), // 31: ermite.ResolveActionsRequest
	2961	+	(*ResolveActionsResponse)(nil), // 32: ermite.ResolveActionsResponse
	2962	+	(*ResolvedAction)(nil), // 33: ermite.ResolvedAction
	2963	+	(*UploadSummaryRequest)(nil), // 34: ermite.UploadSummaryRequest
	2964	+	(*UploadSummaryResponse)(nil), // 35: ermite.UploadSummaryResponse
	2965	+	nil, // 36: ermite.Job.SecretsEntry
	2966	+	nil, // 37: ermite.Job.VarsEntry
	2967	+	nil, // 38: ermite.JobPermissions.LevelsEntry
	2968	+	nil, // 39: ermite.CompleteJobRequest.OutputsEntry
	2969	+	(*durationpb.Duration)(nil), // 40: google.protobuf.Duration
	2970	+	(*timestamppb.Timestamp)(nil), // 41: google.protobuf.Timestamp
2726	2971		}
2727	2972		var file_ermite_runner_proto_depIdxs = []int32{
2728	2973		3, // 0: ermite.RegisterRunnerRequest.isolation:type_name -> ermite.RunnerIsolation
2729	2974		11, // 1: ermite.FetchJobResponse.job:type_name -> ermite.Job
2730		-	35, // 2: ermite.FetchJobResponse.retry_after:type_name -> google.protobuf.Duration
2731		-	13, // 3: ermite.UpdateJobRequest.steps:type_name -> ermite.StepUpdate
2732		-	27, // 4: ermite.UpdateJobRequest.annotations:type_name -> ermite.Annotation
2733		-	2, // 5: ermite.StepUpdate.state:type_name -> ermite.StepState
2734		-	1, // 6: ermite.StepUpdate.conclusion:type_name -> ermite.CiConclusion
2735		-	36, // 7: ermite.StepUpdate.started_at:type_name -> google.protobuf.Timestamp
2736		-	36, // 8: ermite.StepUpdate.completed_at:type_name -> google.protobuf.Timestamp
2737		-	1, // 9: ermite.StepUpdate.outcome:type_name -> ermite.CiConclusion
2738		-	1, // 10: ermite.CompleteJobRequest.conclusion:type_name -> ermite.CiConclusion
2739		-	34, // 11: ermite.CompleteJobRequest.outputs:type_name -> ermite.CompleteJobRequest.OutputsEntry
2740		-	13, // 12: ermite.CompleteJobRequest.steps:type_name -> ermite.StepUpdate
2741		-	27, // 13: ermite.CompleteJobRequest.annotations:type_name -> ermite.Annotation
2742		-	1, // 14: ermite.CompleteJobResponse.conclusion:type_name -> ermite.CiConclusion
2743		-	1, // 15: ermite.JobEnded.conclusion:type_name -> ermite.CiConclusion
2744		-	19, // 16: ermite.AppendLogRequest.lines:type_name -> ermite.LogLine
2745		-	36, // 17: ermite.LogLine.time:type_name -> google.protobuf.Timestamp
2746		-	25, // 18: ermite.WatchJobResponse.keepalive:type_name -> ermite.Keepalive
2747		-	26, // 19: ermite.WatchJobResponse.cancel:type_name -> ermite.CancelRequest
2748		-	17, // 20: ermite.WatchJobResponse.ended:type_name -> ermite.JobEnded
2749		-	4, // 21: ermite.CancelRequest.reason:type_name -> ermite.CancelReason
2750		-	36, // 22: ermite.CancelRequest.requested_at:type_name -> google.protobuf.Timestamp
2751		-	5, // 23: ermite.Annotation.level:type_name -> ermite.AnnotationLevel
2752		-	28, // 24: ermite.ResolveActionsRequest.refs:type_name -> ermite.ActionRef
2753		-	31, // 25: ermite.ResolveActionsResponse.actions:type_name -> ermite.ResolvedAction
2754		-	6, // 26: ermite.ResolvedAction.source:type_name -> ermite.ActionSource
2755		-	7, // 27: ermite.RunnerService.RegisterRunner:input_type -> ermite.RegisterRunnerRequest
2756		-	9, // 28: ermite.RunnerService.FetchJob:input_type -> ermite.FetchJobRequest
2757		-	12, // 29: ermite.RunnerService.UpdateJob:input_type -> ermite.UpdateJobRequest
2758		-	18, // 30: ermite.RunnerService.AppendLog:input_type -> ermite.AppendLogRequest
2759		-	21, // 31: ermite.RunnerService.Heartbeat:input_type -> ermite.HeartbeatRequest
2760		-	23, // 32: ermite.RunnerService.WatchJob:input_type -> ermite.WatchJobRequest
2761		-	15, // 33: ermite.RunnerService.CompleteJob:input_type -> ermite.CompleteJobRequest
2762		-	29, // 34: ermite.RunnerService.ResolveActions:input_type -> ermite.ResolveActionsRequest
2763		-	32, // 35: ermite.RunnerService.UploadSummary:input_type -> ermite.UploadSummaryRequest
2764		-	8, // 36: ermite.RunnerService.RegisterRunner:output_type -> ermite.RegisterRunnerResponse
2765		-	10, // 37: ermite.RunnerService.FetchJob:output_type -> ermite.FetchJobResponse
2766		-	14, // 38: ermite.RunnerService.UpdateJob:output_type -> ermite.UpdateJobResponse
2767		-	20, // 39: ermite.RunnerService.AppendLog:output_type -> ermite.AppendLogResponse
2768		-	22, // 40: ermite.RunnerService.Heartbeat:output_type -> ermite.HeartbeatResponse
2769		-	24, // 41: ermite.RunnerService.WatchJob:output_type -> ermite.WatchJobResponse
2770		-	16, // 42: ermite.RunnerService.CompleteJob:output_type -> ermite.CompleteJobResponse
2771		-	30, // 43: ermite.RunnerService.ResolveActions:output_type -> ermite.ResolveActionsResponse
2772		-	33, // 44: ermite.RunnerService.UploadSummary:output_type -> ermite.UploadSummaryResponse
2773		-	36, // [36:45] is the sub-list for method output_type
2774		-	27, // [27:36] is the sub-list for method input_type
2775		-	27, // [27:27] is the sub-list for extension type_name
2776		-	27, // [27:27] is the sub-list for extension extendee
2777		-	0, // [0:27] is the sub-list for field type_name
	2975	+	40, // 2: ermite.FetchJobResponse.retry_after:type_name -> google.protobuf.Duration
	2976	+	36, // 3: ermite.Job.secrets:type_name -> ermite.Job.SecretsEntry
	2977	+	37, // 4: ermite.Job.vars:type_name -> ermite.Job.VarsEntry
	2978	+	12, // 5: ermite.Job.permissions:type_name -> ermite.JobPermissions
	2979	+	13, // 6: ermite.Job.cache:type_name -> ermite.JobCache
	2980	+	38, // 7: ermite.JobPermissions.levels:type_name -> ermite.JobPermissions.LevelsEntry
	2981	+	15, // 8: ermite.UpdateJobRequest.steps:type_name -> ermite.StepUpdate
	2982	+	29, // 9: ermite.UpdateJobRequest.annotations:type_name -> ermite.Annotation
	2983	+	2, // 10: ermite.StepUpdate.state:type_name -> ermite.StepState
	2984	+	1, // 11: ermite.StepUpdate.conclusion:type_name -> ermite.CiConclusion
	2985	+	41, // 12: ermite.StepUpdate.started_at:type_name -> google.protobuf.Timestamp
	2986	+	41, // 13: ermite.StepUpdate.completed_at:type_name -> google.protobuf.Timestamp
	2987	+	1, // 14: ermite.StepUpdate.outcome:type_name -> ermite.CiConclusion
	2988	+	1, // 15: ermite.CompleteJobRequest.conclusion:type_name -> ermite.CiConclusion
	2989	+	39, // 16: ermite.CompleteJobRequest.outputs:type_name -> ermite.CompleteJobRequest.OutputsEntry
	2990	+	15, // 17: ermite.CompleteJobRequest.steps:type_name -> ermite.StepUpdate
	2991	+	29, // 18: ermite.CompleteJobRequest.annotations:type_name -> ermite.Annotation
	2992	+	1, // 19: ermite.CompleteJobResponse.conclusion:type_name -> ermite.CiConclusion
	2993	+	1, // 20: ermite.JobEnded.conclusion:type_name -> ermite.CiConclusion
	2994	+	21, // 21: ermite.AppendLogRequest.lines:type_name -> ermite.LogLine
	2995	+	41, // 22: ermite.LogLine.time:type_name -> google.protobuf.Timestamp
	2996	+	27, // 23: ermite.WatchJobResponse.keepalive:type_name -> ermite.Keepalive
	2997	+	28, // 24: ermite.WatchJobResponse.cancel:type_name -> ermite.CancelRequest
	2998	+	19, // 25: ermite.WatchJobResponse.ended:type_name -> ermite.JobEnded
	2999	+	4, // 26: ermite.CancelRequest.reason:type_name -> ermite.CancelReason
	3000	+	41, // 27: ermite.CancelRequest.requested_at:type_name -> google.protobuf.Timestamp
	3001	+	5, // 28: ermite.Annotation.level:type_name -> ermite.AnnotationLevel
	3002	+	30, // 29: ermite.ResolveActionsRequest.refs:type_name -> ermite.ActionRef
	3003	+	33, // 30: ermite.ResolveActionsResponse.actions:type_name -> ermite.ResolvedAction
	3004	+	6, // 31: ermite.ResolvedAction.source:type_name -> ermite.ActionSource
	3005	+	7, // 32: ermite.RunnerService.RegisterRunner:input_type -> ermite.RegisterRunnerRequest
	3006	+	9, // 33: ermite.RunnerService.FetchJob:input_type -> ermite.FetchJobRequest
	3007	+	14, // 34: ermite.RunnerService.UpdateJob:input_type -> ermite.UpdateJobRequest
	3008	+	20, // 35: ermite.RunnerService.AppendLog:input_type -> ermite.AppendLogRequest
	3009	+	23, // 36: ermite.RunnerService.Heartbeat:input_type -> ermite.HeartbeatRequest
	3010	+	25, // 37: ermite.RunnerService.WatchJob:input_type -> ermite.WatchJobRequest
	3011	+	17, // 38: ermite.RunnerService.CompleteJob:input_type -> ermite.CompleteJobRequest
	3012	+	31, // 39: ermite.RunnerService.ResolveActions:input_type -> ermite.ResolveActionsRequest
	3013	+	34, // 40: ermite.RunnerService.UploadSummary:input_type -> ermite.UploadSummaryRequest
	3014	+	8, // 41: ermite.RunnerService.RegisterRunner:output_type -> ermite.RegisterRunnerResponse
	3015	+	10, // 42: ermite.RunnerService.FetchJob:output_type -> ermite.FetchJobResponse
	3016	+	16, // 43: ermite.RunnerService.UpdateJob:output_type -> ermite.UpdateJobResponse
	3017	+	22, // 44: ermite.RunnerService.AppendLog:output_type -> ermite.AppendLogResponse
	3018	+	24, // 45: ermite.RunnerService.Heartbeat:output_type -> ermite.HeartbeatResponse
	3019	+	26, // 46: ermite.RunnerService.WatchJob:output_type -> ermite.WatchJobResponse
	3020	+	18, // 47: ermite.RunnerService.CompleteJob:output_type -> ermite.CompleteJobResponse
	3021	+	32, // 48: ermite.RunnerService.ResolveActions:output_type -> ermite.ResolveActionsResponse
	3022	+	35, // 49: ermite.RunnerService.UploadSummary:output_type -> ermite.UploadSummaryResponse
	3023	+	41, // [41:50] is the sub-list for method output_type
	3024	+	32, // [32:41] is the sub-list for method input_type
	3025	+	32, // [32:32] is the sub-list for extension type_name
	3026	+	32, // [32:32] is the sub-list for extension extendee
	3027	+	0, // [0:32] is the sub-list for field type_name
2778	3028		}
2779	3029
2780	3030		func init() { file_ermite_runner_proto_init() }

@@ -2782,7 +3032,7 @@ func file_ermite_runner_proto_init() {
2782	3032		if File_ermite_runner_proto != nil {
2783	3033		return
2784	3034		}
2785		-	file_ermite_runner_proto_msgTypes[17].OneofWrappers = []any{
	3035	+	file_ermite_runner_proto_msgTypes[19].OneofWrappers = []any{
2786	3036		(*WatchJobResponse_Keepalive)(nil),
2787	3037		(*WatchJobResponse_Cancel)(nil),
2788	3038		(*WatchJobResponse_Ended)(nil),

@@ -2793,7 +3043,7 @@ func file_ermite_runner_proto_init() {
2793	3043		GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
2794	3044		RawDescriptor: unsafe.Slice(unsafe.StringData(file_ermite_runner_proto_rawDesc), len(file_ermite_runner_proto_rawDesc)),
2795	3045		NumEnums: 7,
2796		-	NumMessages: 28,
	3046	+	NumMessages: 33,
2797	3047		NumExtensions: 0,
2798	3048		NumServices: 1,
2799	3049		},

 	CiStatus_CI_STATUS_IN_PROGRESS CiStatus = 2
 	// Over. The conclusion says how it ended.
 	CiStatus_CI_STATUS_COMPLETED CiStatus = 3
+	// Held back by a concurrency group: another run or job of the group is
+	// running, or a newer one is waiting (see RunJob.concurrency_group). Only for
+	// jobs and checks, and only from servers with the feature "ci.concurrency";
+	// a client that does not know the value shows it as queued.
+	CiStatus_CI_STATUS_PENDING CiStatus = 4
 )
 // Enum value maps for CiStatus.
 		1: "CI_STATUS_QUEUED",
 		2: "CI_STATUS_IN_PROGRESS",
 		3: "CI_STATUS_COMPLETED",
+		4: "CI_STATUS_PENDING",
 	}
 	CiStatus_value = map[string]int32{
 		"CI_STATUS_UNSPECIFIED": 0,
 		"CI_STATUS_QUEUED":      1,
 		"CI_STATUS_IN_PROGRESS": 2,
 		"CI_STATUS_COMPLETED":   3,
+		"CI_STATUS_PENDING":     4,
 	}
 )
 	// "secrets.GITHUB_TOKEN" of the job: "ermitegh_" and 43 base64url characters
 	// (32 random bytes, no padding). Unlike job_token it is meant for the code of
 	// the job: the runner gives it to the sandbox (actions/checkout clones with
-	// it). It can only read the repository of the run (read-only, whatever
+	// it). It can only act on the repository of the run: read-only from servers
-	// "permissions:" says), and is valid from the assignment until the job ends
+	// without the feature "ci.secrets", whatever "permissions:" says, and with
+	// the rights of permissions from those that have it (never more than read
+	// when trusted is false). It is valid from the assignment until the job ends
 	// (it is revoked then, on cancellation and when the job is lost). It is a
 	// secret: the runner registers it in its masker before anything runs, and
 	// neither the runner nor the server logs it. It is shown only in this
 	// response, or in a repeat of the same poll_id; a new assignment of the same
 	// job has a new one. Empty from servers without the feature "ci.actions".
-	GithubToken   string `protobuf:"bytes,15,opt,name=github_token,json=githubToken,proto3" json:"github_token,omitempty"`
+	GithubToken string `protobuf:"bytes,15,opt,name=github_token,json=githubToken,proto3" json:"github_token,omitempty"`
+	// Secrets are the secrets of the job by name (upper case), in plain text:
+	// the ones the job's workflow refers to, from the instance, the repository
+	// and the environment, with the environment overriding the repository and
+	// the repository the instance. The server picks them; the runner uses them
+	// as they are. They are empty when the job is not trusted, when the job
+	// refers to none, and from servers without the feature "ci.secrets"; the
+	// "GITHUB_TOKEN" secret is github_token, not an entry here. They travel only
+	// over the runner's authenticated channel. The runner never logs them, never
+	// writes them to disk or to its recovery state, and registers them in its
+	// log masker before the first step runs, as GitHub's runner does: each value
+	// trimmed, each non-empty trimmed line of it (split on CR and LF), and the
+	// encoded forms of each. The server never stores them in the run record nor
+	// logs them. Treat the whole map as a secret.
+	Secrets map[string]string `protobuf:"bytes,16,rep,name=secrets,proto3" json:"secrets,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Vars are the configuration variables of the job by name (upper case),
+	// already merged by the server with environment over repository over
+	// instance. They are not secret. The same values are in the "vars" context
+	// of contexts, which the runner may use instead. Empty from servers without
+	// the feature "ci.secrets".
+	Vars map[string]string `protobuf:"bytes,17,rep,name=vars,proto3" json:"vars,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Environment is the name of the environment the job deploys to (the
+	// evaluated "environment:" of the job). Empty when the job has none. It is
+	// environment that secrets and vars were resolved for.
+	Environment string `protobuf:"bytes,18,opt,name=environment,proto3" json:"environment,omitempty"`
+	// Permissions are the effective permissions of github_token. Unset from
+	// servers without the feature "ci.secrets"; the token is then read-only.
+	Permissions *JobPermissions `protobuf:"bytes,19,opt,name=permissions,proto3" json:"permissions,omitempty"`
+	// Cache tells the runner which cache entries the job may read and write.
+	// Unset when the server gives the job no cache (the runner then serves no
+	// cache) and from servers without the feature "ci.cache".
+	Cache *JobCache `protobuf:"bytes,20,opt,name=cache,proto3" json:"cache,omitempty"`
+	// Trusted is true when the run's actor is the owner (or a re-run of a
+	// trusted run by the owner): only then are secrets sent and a write
+	// permission granted. It is false when the actor is a token limited to
+	// branches (an automated agent could otherwise print any secret by pushing a
+	// workflow) and for a re-run of such a run, and then secrets is empty and
+	// github_token is read-only whatever "permissions:" says. The runner states
+	// this in the log of "Set up job". False from servers that do not send it:
+	// the safe reading.
+	Trusted       bool `protobuf:"varint,21,opt,name=trusted,proto3" json:"trusted,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 	return ""
 }
+func (x *Job) GetSecrets() map[string]string {
+	if x != nil {
+		return x.Secrets
+	}
+	return nil
+}
+func (x *Job) GetVars() map[string]string {
+	if x != nil {
+		return x.Vars
+	}
+	return nil
+}
+func (x *Job) GetEnvironment() string {
+	if x != nil {
+		return x.Environment
+	}
+	return ""
+}
+func (x *Job) GetPermissions() *JobPermissions {
+	if x != nil {
+		return x.Permissions
+	}
+	return nil
+}
+func (x *Job) GetCache() *JobCache {
+	if x != nil {
+		return x.Cache
+	}
+	return nil
+}
+func (x *Job) GetTrusted() bool {
+	if x != nil {
+		return x.Trusted
+	}
+	return false
+}
+// JobPermissions are the permissions of the job repository token, with the
+// keys and values of the "permissions:" of a GitHub workflow.
+type JobPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Levels maps a permission key ("contents", "pull-requests", "id-token",
+	// "actions", ...) to "read", "write" or "none". They are the permissions in
+	// effect after the server merged the workflow's and the job's "permissions:"
+	// (and the caller's, for a reusable workflow) and applied the trust rule of
+	// Job.trusted; a key absent from the map is "none". Keys are lowercase as in
+	// the workflow. The runner prints them in "Set up job" and does not
+	// enforce them: the server checks the token.
+	Levels        map[string]string `protobuf:"bytes,1,rep,name=levels,proto3" json:"levels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+func (x *JobPermissions) Reset() {
+	*x = JobPermissions{}
+	mi := &file_ermite_runner_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+func (x *JobPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+func (*JobPermissions) ProtoMessage() {}
+func (x *JobPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_ermite_runner_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+// Deprecated: Use JobPermissions.ProtoReflect.Descriptor instead.
+func (*JobPermissions) Descriptor() ([]byte, []int) {
+	return file_ermite_runner_proto_rawDescGZIP(), []int{5}
+}
+func (x *JobPermissions) GetLevels() map[string]string {
+	if x != nil {
+		return x.Levels
+	}
+	return nil
+}
+// JobCache is the scope of the cache of one job. The cache is served by the
+// runner and shared by the jobs of a repository, as GitHub scopes it.
+type JobCache struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Repository is the name of the repository whose cache the job uses. Entries
+	// of another repository are never visible to it.
+	Repository string `protobuf:"bytes,1,opt,name=repository,proto3" json:"repository,omitempty"`
+	// WriteRef is the only ref the job may save entries under, for example
+	// "refs/heads/main" or "refs/pull/7/merge".
+	WriteRef string `protobuf:"bytes,2,opt,name=write_ref,json=writeRef,proto3" json:"write_ref,omitempty"`
+	// ReadRefs are the refs the job may restore entries from, most specific
+	// first: the ref of the run, then the base branch for a pull request, then
+	// the default branch. Entries under other refs are never restored.
+	ReadRefs      []string `protobuf:"bytes,3,rep,name=read_refs,json=readRefs,proto3" json:"read_refs,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+func (x *JobCache) Reset() {
+	*x = JobCache{}
+	mi := &file_ermite_runner_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+func (x *JobCache) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+func (*JobCache) ProtoMessage() {}
+func (x *JobCache) ProtoReflect() protoreflect.Message {
+	mi := &file_ermite_runner_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+// Deprecated: Use JobCache.ProtoReflect.Descriptor instead.
+func (*JobCache) Descriptor() ([]byte, []int) {
+	return file_ermite_runner_proto_rawDescGZIP(), []int{6}
+}
+func (x *JobCache) GetRepository() string {
+	if x != nil {
+		return x.Repository
+	}
+	return ""
+}
+func (x *JobCache) GetWriteRef() string {
+	if x != nil {
+		return x.WriteRef
+	}
+	return ""
+}
+func (x *JobCache) GetReadRefs() []string {
+	if x != nil {
+		return x.ReadRefs
+	}
+	return nil
+}
 // UpdateJobRequest reports the steps of a running job.
 type UpdateJobRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 func (x *UpdateJobRequest) Reset() {
 	*x = UpdateJobRequest{}
-	mi := &file_ermite_runner_proto_msgTypes[5]
+	mi := &file_ermite_runner_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*UpdateJobRequest) ProtoMessage() {}
 func (x *UpdateJobRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[5]
+	mi := &file_ermite_runner_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use UpdateJobRequest.ProtoReflect.Descriptor instead.
 func (*UpdateJobRequest) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{5}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{7}
 }
 func (x *UpdateJobRequest) GetJobId() string {
 func (x *StepUpdate) Reset() {
 	*x = StepUpdate{}
-	mi := &file_ermite_runner_proto_msgTypes[6]
+	mi := &file_ermite_runner_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*StepUpdate) ProtoMessage() {}
 func (x *StepUpdate) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[6]
+	mi := &file_ermite_runner_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use StepUpdate.ProtoReflect.Descriptor instead.
 func (*StepUpdate) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{6}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{8}
 }
 func (x *StepUpdate) GetNumber() int32 {
 func (x *UpdateJobResponse) Reset() {
 	*x = UpdateJobResponse{}
-	mi := &file_ermite_runner_proto_msgTypes[7]
+	mi := &file_ermite_runner_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*UpdateJobResponse) ProtoMessage() {}
 func (x *UpdateJobResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[7]
+	mi := &file_ermite_runner_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use UpdateJobResponse.ProtoReflect.Descriptor instead.
 func (*UpdateJobResponse) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{7}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{9}
 }
 // CompleteJobRequest ends a job.
 	// are invalid_argument. Each value is at most 1 MiB, and all names and
 	// values together at most 1 MiB (1,048,576 bytes); beyond that the whole call
 	// is rejected with invalid_argument and the runner reports the failure of
-	// the job without outputs, with a line in the log.
+	// the job without outputs, with a line in the log. The runner leaves out an
+	// output whose value its masker would change, with the warning "Skip output
+	// '<name>' since it may contain secret." (as GitHub's runner), so no secret
+	// reaches the server through outputs.
 	Outputs map[string]string `protobuf:"bytes,3,rep,name=outputs,proto3" json:"outputs,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// RunnerShutdown is true when the runner ends the job because it was told to
 	// stop (service stopped, signal). Only allowed with CI_CONCLUSION_CANCELLED.
 func (x *CompleteJobRequest) Reset() {
 	*x = CompleteJobRequest{}
-	mi := &file_ermite_runner_proto_msgTypes[8]
+	mi := &file_ermite_runner_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*CompleteJobRequest) ProtoMessage() {}
 func (x *CompleteJobRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[8]
+	mi := &file_ermite_runner_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use CompleteJobRequest.ProtoReflect.Descriptor instead.
 func (*CompleteJobRequest) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{8}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{10}
 }
 func (x *CompleteJobRequest) GetJobId() string {
 func (x *CompleteJobResponse) Reset() {
 	*x = CompleteJobResponse{}
-	mi := &file_ermite_runner_proto_msgTypes[9]
+	mi := &file_ermite_runner_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*CompleteJobResponse) ProtoMessage() {}
 func (x *CompleteJobResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[9]
+	mi := &file_ermite_runner_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use CompleteJobResponse.ProtoReflect.Descriptor instead.
 func (*CompleteJobResponse) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{9}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{11}
 }
 func (x *CompleteJobResponse) GetConclusion() CiConclusion {
 func (x *JobEnded) Reset() {
 	*x = JobEnded{}
-	mi := &file_ermite_runner_proto_msgTypes[10]
+	mi := &file_ermite_runner_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*JobEnded) ProtoMessage() {}
 func (x *JobEnded) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[10]
+	mi := &file_ermite_runner_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use JobEnded.ProtoReflect.Descriptor instead.
 func (*JobEnded) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{10}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{12}
 }
 func (x *JobEnded) GetConclusion() CiConclusion {
 func (x *AppendLogRequest) Reset() {
 	*x = AppendLogRequest{}
-	mi := &file_ermite_runner_proto_msgTypes[11]
+	mi := &file_ermite_runner_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*AppendLogRequest) ProtoMessage() {}
 func (x *AppendLogRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[11]
+	mi := &file_ermite_runner_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use AppendLogRequest.ProtoReflect.Descriptor instead.
 func (*AppendLogRequest) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{11}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{13}
 }
 func (x *AppendLogRequest) GetJobId() string {
 func (x *LogLine) Reset() {
 	*x = LogLine{}
-	mi := &file_ermite_runner_proto_msgTypes[12]
+	mi := &file_ermite_runner_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*LogLine) ProtoMessage() {}
 func (x *LogLine) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[12]
+	mi := &file_ermite_runner_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use LogLine.ProtoReflect.Descriptor instead.
 func (*LogLine) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{12}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{14}
 }
 func (x *LogLine) GetTime() *timestamppb.Timestamp {
 func (x *AppendLogResponse) Reset() {
 	*x = AppendLogResponse{}
-	mi := &file_ermite_runner_proto_msgTypes[13]
+	mi := &file_ermite_runner_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*AppendLogResponse) ProtoMessage() {}
 func (x *AppendLogResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[13]
+	mi := &file_ermite_runner_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use AppendLogResponse.ProtoReflect.Descriptor instead.
 func (*AppendLogResponse) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{13}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{15}
 }
 func (x *AppendLogResponse) GetNextOffset() int64 {
 func (x *HeartbeatRequest) Reset() {
 	*x = HeartbeatRequest{}
-	mi := &file_ermite_runner_proto_msgTypes[14]
+	mi := &file_ermite_runner_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*HeartbeatRequest) ProtoMessage() {}
 func (x *HeartbeatRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[14]
+	mi := &file_ermite_runner_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use HeartbeatRequest.ProtoReflect.Descriptor instead.
 func (*HeartbeatRequest) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{14}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{16}
 }
 func (x *HeartbeatRequest) GetJobId() string {
 func (x *HeartbeatResponse) Reset() {
 	*x = HeartbeatResponse{}
-	mi := &file_ermite_runner_proto_msgTypes[15]
+	mi := &file_ermite_runner_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*HeartbeatResponse) ProtoMessage() {}
 func (x *HeartbeatResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[15]
+	mi := &file_ermite_runner_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use HeartbeatResponse.ProtoReflect.Descriptor instead.
 func (*HeartbeatResponse) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{15}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{17}
 }
 // WatchJobRequest names the job to watch.
 func (x *WatchJobRequest) Reset() {
 	*x = WatchJobRequest{}
-	mi := &file_ermite_runner_proto_msgTypes[16]
+	mi := &file_ermite_runner_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*WatchJobRequest) ProtoMessage() {}
 func (x *WatchJobRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[16]
+	mi := &file_ermite_runner_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use WatchJobRequest.ProtoReflect.Descriptor instead.
 func (*WatchJobRequest) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{16}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{18}
 }
 func (x *WatchJobRequest) GetJobId() string {
 func (x *WatchJobResponse) Reset() {
 	*x = WatchJobResponse{}
-	mi := &file_ermite_runner_proto_msgTypes[17]
+	mi := &file_ermite_runner_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*WatchJobResponse) ProtoMessage() {}
 func (x *WatchJobResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[17]
+	mi := &file_ermite_runner_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use WatchJobResponse.ProtoReflect.Descriptor instead.
 func (*WatchJobResponse) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{17}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{19}
 }
 func (x *WatchJobResponse) GetMsg() isWatchJobResponse_Msg {
 func (x *Keepalive) Reset() {
 	*x = Keepalive{}
-	mi := &file_ermite_runner_proto_msgTypes[18]
+	mi := &file_ermite_runner_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*Keepalive) ProtoMessage() {}
 func (x *Keepalive) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[18]
+	mi := &file_ermite_runner_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use Keepalive.ProtoReflect.Descriptor instead.
 func (*Keepalive) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{18}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{20}
 }
 // CancelRequest asks the runner to stop a job.
 func (x *CancelRequest) Reset() {
 	*x = CancelRequest{}
-	mi := &file_ermite_runner_proto_msgTypes[19]
+	mi := &file_ermite_runner_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*CancelRequest) ProtoMessage() {}
 func (x *CancelRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[19]
+	mi := &file_ermite_runner_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use CancelRequest.ProtoReflect.Descriptor instead.
 func (*CancelRequest) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{19}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{21}
 }
 func (x *CancelRequest) GetReason() CancelReason {
 func (x *Annotation) Reset() {
 	*x = Annotation{}
-	mi := &file_ermite_runner_proto_msgTypes[20]
+	mi := &file_ermite_runner_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*Annotation) ProtoMessage() {}
 func (x *Annotation) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[20]
+	mi := &file_ermite_runner_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use Annotation.ProtoReflect.Descriptor instead.
 func (*Annotation) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{20}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{22}
 }
 func (x *Annotation) GetLevel() AnnotationLevel {
 func (x *ActionRef) Reset() {
 	*x = ActionRef{}
-	mi := &file_ermite_runner_proto_msgTypes[21]
+	mi := &file_ermite_runner_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*ActionRef) ProtoMessage() {}
 func (x *ActionRef) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[21]
+	mi := &file_ermite_runner_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use ActionRef.ProtoReflect.Descriptor instead.
 func (*ActionRef) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{21}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{23}
 }
 func (x *ActionRef) GetUses() string {
 func (x *ResolveActionsRequest) Reset() {
 	*x = ResolveActionsRequest{}
-	mi := &file_ermite_runner_proto_msgTypes[22]
+	mi := &file_ermite_runner_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*ResolveActionsRequest) ProtoMessage() {}
 func (x *ResolveActionsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[22]
+	mi := &file_ermite_runner_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use ResolveActionsRequest.ProtoReflect.Descriptor instead.
 func (*ResolveActionsRequest) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{22}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{24}
 }
 func (x *ResolveActionsRequest) GetJobId() string {
 func (x *ResolveActionsResponse) Reset() {
 	*x = ResolveActionsResponse{}
-	mi := &file_ermite_runner_proto_msgTypes[23]
+	mi := &file_ermite_runner_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*ResolveActionsResponse) ProtoMessage() {}
 func (x *ResolveActionsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[23]
+	mi := &file_ermite_runner_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use ResolveActionsResponse.ProtoReflect.Descriptor instead.
 func (*ResolveActionsResponse) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{23}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{25}
 }
 func (x *ResolveActionsResponse) GetActions() []*ResolvedAction {
 func (x *ResolvedAction) Reset() {
 	*x = ResolvedAction{}
-	mi := &file_ermite_runner_proto_msgTypes[24]
+	mi := &file_ermite_runner_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*ResolvedAction) ProtoMessage() {}
 func (x *ResolvedAction) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[24]
+	mi := &file_ermite_runner_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use ResolvedAction.ProtoReflect.Descriptor instead.
 func (*ResolvedAction) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{24}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{26}
 }
 func (x *ResolvedAction) GetRef() string {
 func (x *UploadSummaryRequest) Reset() {
 	*x = UploadSummaryRequest{}
-	mi := &file_ermite_runner_proto_msgTypes[25]
+	mi := &file_ermite_runner_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*UploadSummaryRequest) ProtoMessage() {}
 func (x *UploadSummaryRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[25]
+	mi := &file_ermite_runner_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use UploadSummaryRequest.ProtoReflect.Descriptor instead.
 func (*UploadSummaryRequest) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{25}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{27}
 }
 func (x *UploadSummaryRequest) GetJobId() string {
 func (x *UploadSummaryResponse) Reset() {
 	*x = UploadSummaryResponse{}
-	mi := &file_ermite_runner_proto_msgTypes[26]
+	mi := &file_ermite_runner_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*UploadSummaryResponse) ProtoMessage() {}
 func (x *UploadSummaryResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ermite_runner_proto_msgTypes[26]
+	mi := &file_ermite_runner_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use UploadSummaryResponse.ProtoReflect.Descriptor instead.
 func (*UploadSummaryResponse) Descriptor() ([]byte, []int) {
-	return file_ermite_runner_proto_rawDescGZIP(), []int{26}
+	return file_ermite_runner_proto_rawDescGZIP(), []int{28}
 }
 var File_ermite_runner_proto protoreflect.FileDescriptor
 	"\x10FetchJobResponse\x12\x1d\n" +
 	"\x03job\x18\x01 \x01(\v2\v.ermite.JobR\x03job\x12:\n" +
 	"\vretry_after\x18\x02 \x01(\v2\x19.google.protobuf.DurationR\n" +
-	"retryAfter\"\x9d\x03\n" +
+	"retryAfter\"\x8f\x06\n" +
 	"\x03Job\x12\x15\n" +
 	"\x06job_id\x18\x01 \x01(\tR\x05jobId\x12\x15\n" +
 	"\x06run_id\x18\x02 \x01(\x03R\x05runId\x12\x18\n" +
 	"\x04repo\x18\f \x01(\tR\x04repo\x12\x10\n" +
 	"\x03sha\x18\r \x01(\tR\x03sha\x12\x10\n" +
 	"\x03ref\x18\x0e \x01(\tR\x03ref\x12!\n" +
-	"\fgithub_token\x18\x0f \x01(\tR\vgithubToken\"\x89\x01\n" +
+	"\fgithub_token\x18\x0f \x01(\tR\vgithubToken\x122\n" +
+	"\asecrets\x18\x10 \x03(\v2\x18.ermite.Job.SecretsEntryR\asecrets\x12)\n" +
+	"\x04vars\x18\x11 \x03(\v2\x15.ermite.Job.VarsEntryR\x04vars\x12 \n" +
+	"\venvironment\x18\x12 \x01(\tR\venvironment\x128\n" +
+	"\vpermissions\x18\x13 \x01(\v2\x16.ermite.JobPermissionsR\vpermissions\x12&\n" +
+	"\x05cache\x18\x14 \x01(\v2\x10.ermite.JobCacheR\x05cache\x12\x18\n" +
+	"\atrusted\x18\x15 \x01(\bR\atrusted\x1a:\n" +
+	"\fSecretsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a7\n" +
+	"\tVarsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x87\x01\n" +
+	"\x0eJobPermissions\x12:\n" +
+	"\x06levels\x18\x01 \x03(\v2\".ermite.JobPermissions.LevelsEntryR\x06levels\x1a9\n" +
+	"\vLevelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"d\n" +
+	"\bJobCache\x12\x1e\n" +
+	"\n" +
+	"repository\x18\x01 \x01(\tR\n" +
+	"repository\x12\x1b\n" +
+	"\twrite_ref\x18\x02 \x01(\tR\bwriteRef\x12\x1b\n" +
+	"\tread_refs\x18\x03 \x03(\tR\breadRefs\"\x89\x01\n" +
 	"\x10UpdateJobRequest\x12\x15\n" +
 	"\x06job_id\x18\x01 \x01(\tR\x05jobId\x12(\n" +
 	"\x05steps\x18\x02 \x03(\v2\x12.ermite.StepUpdateR\x05steps\x124\n" +
 	"\vstep_number\x18\x02 \x01(\x05R\n" +
 	"stepNumber\x12\x1a\n" +
 	"\bmarkdown\x18\x03 \x01(\tR\bmarkdown\"\x17\n" +
-	"\x15UploadSummaryResponse*o\n" +
+	"\x15UploadSummaryResponse*\x86\x01\n" +
 	"\bCiStatus\x12\x19\n" +
 	"\x15CI_STATUS_UNSPECIFIED\x10\x00\x12\x14\n" +
 	"\x10CI_STATUS_QUEUED\x10\x01\x12\x19\n" +
 	"\x15CI_STATUS_IN_PROGRESS\x10\x02\x12\x17\n" +
-	"\x13CI_STATUS_COMPLETED\x10\x03*\xf6\x01\n" +
+	"\x13CI_STATUS_COMPLETED\x10\x03\x12\x15\n" +
+	"\x11CI_STATUS_PENDING\x10\x04*\xf6\x01\n" +
 	"\fCiConclusion\x12\x1d\n" +
 	"\x19CI_CONCLUSION_UNSPECIFIED\x10\x00\x12\x19\n" +
 	"\x15CI_CONCLUSION_SUCCESS\x10\x01\x12\x19\n" +
 }
 var file_ermite_runner_proto_enumTypes = make([]protoimpl.EnumInfo, 7)
-var file_ermite_runner_proto_msgTypes = make([]protoimpl.MessageInfo, 28)
+var file_ermite_runner_proto_msgTypes = make([]protoimpl.MessageInfo, 33)
 var file_ermite_runner_proto_goTypes = []any{
 	(CiStatus)(0),                  // 0: ermite.CiStatus
 	(CiConclusion)(0),              // 1: ermite.CiConclusion
 	(*FetchJobRequest)(nil),        // 9: ermite.FetchJobRequest
 	(*FetchJobResponse)(nil),       // 10: ermite.FetchJobResponse
 	(*Job)(nil),                    // 11: ermite.Job
-	(*UpdateJobRequest)(nil),       // 12: ermite.UpdateJobRequest
+	(*JobPermissions)(nil),         // 12: ermite.JobPermissions
-	(*StepUpdate)(nil),             // 13: ermite.StepUpdate
+	(*JobCache)(nil),               // 13: ermite.JobCache
-	(*UpdateJobResponse)(nil),      // 14: ermite.UpdateJobResponse
+	(*UpdateJobRequest)(nil),       // 14: ermite.UpdateJobRequest
-	(*CompleteJobRequest)(nil),     // 15: ermite.CompleteJobRequest
+	(*StepUpdate)(nil),             // 15: ermite.StepUpdate
-	(*CompleteJobResponse)(nil),    // 16: ermite.CompleteJobResponse
+	(*UpdateJobResponse)(nil),      // 16: ermite.UpdateJobResponse
-	(*JobEnded)(nil),               // 17: ermite.JobEnded
+	(*CompleteJobRequest)(nil),     // 17: ermite.CompleteJobRequest
-	(*AppendLogRequest)(nil),       // 18: ermite.AppendLogRequest
+	(*CompleteJobResponse)(nil),    // 18: ermite.CompleteJobResponse
-	(*LogLine)(nil),                // 19: ermite.LogLine
+	(*JobEnded)(nil),               // 19: ermite.JobEnded
-	(*AppendLogResponse)(nil),      // 20: ermite.AppendLogResponse
+	(*AppendLogRequest)(nil),       // 20: ermite.AppendLogRequest
-	(*HeartbeatRequest)(nil),       // 21: ermite.HeartbeatRequest
+	(*LogLine)(nil),                // 21: ermite.LogLine
-	(*HeartbeatResponse)(nil),      // 22: ermite.HeartbeatResponse
+	(*AppendLogResponse)(nil),      // 22: ermite.AppendLogResponse
-	(*WatchJobRequest)(nil),        // 23: ermite.WatchJobRequest
+	(*HeartbeatRequest)(nil),       // 23: ermite.HeartbeatRequest
-	(*WatchJobResponse)(nil),       // 24: ermite.WatchJobResponse
+	(*HeartbeatResponse)(nil),      // 24: ermite.HeartbeatResponse
-	(*Keepalive)(nil),              // 25: ermite.Keepalive
+	(*WatchJobRequest)(nil),        // 25: ermite.WatchJobRequest
-	(*CancelRequest)(nil),          // 26: ermite.CancelRequest
+	(*WatchJobResponse)(nil),       // 26: ermite.WatchJobResponse
-	(*Annotation)(nil),             // 27: ermite.Annotation
+	(*Keepalive)(nil),              // 27: ermite.Keepalive
-	(*ActionRef)(nil),              // 28: ermite.ActionRef
+	(*CancelRequest)(nil),          // 28: ermite.CancelRequest
-	(*ResolveActionsRequest)(nil),  // 29: ermite.ResolveActionsRequest
+	(*Annotation)(nil),             // 29: ermite.Annotation
-	(*ResolveActionsResponse)(nil), // 30: ermite.ResolveActionsResponse
+	(*ActionRef)(nil),              // 30: ermite.ActionRef
-	(*ResolvedAction)(nil),         // 31: ermite.ResolvedAction
+	(*ResolveActionsRequest)(nil),  // 31: ermite.ResolveActionsRequest
-	(*UploadSummaryRequest)(nil),   // 32: ermite.UploadSummaryRequest
+	(*ResolveActionsResponse)(nil), // 32: ermite.ResolveActionsResponse
-	(*UploadSummaryResponse)(nil),  // 33: ermite.UploadSummaryResponse
+	(*ResolvedAction)(nil),         // 33: ermite.ResolvedAction
-	nil,                            // 34: ermite.CompleteJobRequest.OutputsEntry
+	(*UploadSummaryRequest)(nil),   // 34: ermite.UploadSummaryRequest
-	(*durationpb.Duration)(nil),    // 35: google.protobuf.Duration
+	(*UploadSummaryResponse)(nil),  // 35: ermite.UploadSummaryResponse
-	(*timestamppb.Timestamp)(nil),  // 36: google.protobuf.Timestamp
+	nil,                            // 36: ermite.Job.SecretsEntry
+	nil,                            // 37: ermite.Job.VarsEntry
+	nil,                            // 38: ermite.JobPermissions.LevelsEntry
+	nil,                            // 39: ermite.CompleteJobRequest.OutputsEntry
+	(*durationpb.Duration)(nil),    // 40: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),  // 41: google.protobuf.Timestamp
 }
 var file_ermite_runner_proto_depIdxs = []int32{
 	3,  // 0: ermite.RegisterRunnerRequest.isolation:type_name -> ermite.RunnerIsolation
 	11, // 1: ermite.FetchJobResponse.job:type_name -> ermite.Job
-	35, // 2: ermite.FetchJobResponse.retry_after:type_name -> google.protobuf.Duration
+	40, // 2: ermite.FetchJobResponse.retry_after:type_name -> google.protobuf.Duration
-	13, // 3: ermite.UpdateJobRequest.steps:type_name -> ermite.StepUpdate
+	36, // 3: ermite.Job.secrets:type_name -> ermite.Job.SecretsEntry
-	27, // 4: ermite.UpdateJobRequest.annotations:type_name -> ermite.Annotation
+	37, // 4: ermite.Job.vars:type_name -> ermite.Job.VarsEntry
-	2,  // 5: ermite.StepUpdate.state:type_name -> ermite.StepState
+	12, // 5: ermite.Job.permissions:type_name -> ermite.JobPermissions
-	1,  // 6: ermite.StepUpdate.conclusion:type_name -> ermite.CiConclusion
+	13, // 6: ermite.Job.cache:type_name -> ermite.JobCache
-	36, // 7: ermite.StepUpdate.started_at:type_name -> google.protobuf.Timestamp
+	38, // 7: ermite.JobPermissions.levels:type_name -> ermite.JobPermissions.LevelsEntry
-	36, // 8: ermite.StepUpdate.completed_at:type_name -> google.protobuf.Timestamp
+	15, // 8: ermite.UpdateJobRequest.steps:type_name -> ermite.StepUpdate
-	1,  // 9: ermite.StepUpdate.outcome:type_name -> ermite.CiConclusion
+	29, // 9: ermite.UpdateJobRequest.annotations:type_name -> ermite.Annotation
-	1,  // 10: ermite.CompleteJobRequest.conclusion:type_name -> ermite.CiConclusion
+	2,  // 10: ermite.StepUpdate.state:type_name -> ermite.StepState
-	34, // 11: ermite.CompleteJobRequest.outputs:type_name -> ermite.CompleteJobRequest.OutputsEntry
+	1,  // 11: ermite.StepUpdate.conclusion:type_name -> ermite.CiConclusion
-	13, // 12: ermite.CompleteJobRequest.steps:type_name -> ermite.StepUpdate
+	41, // 12: ermite.StepUpdate.started_at:type_name -> google.protobuf.Timestamp
-	27, // 13: ermite.CompleteJobRequest.annotations:type_name -> ermite.Annotation
+	41, // 13: ermite.StepUpdate.completed_at:type_name -> google.protobuf.Timestamp
-	1,  // 14: ermite.CompleteJobResponse.conclusion:type_name -> ermite.CiConclusion
+	1,  // 14: ermite.StepUpdate.outcome:type_name -> ermite.CiConclusion
-	1,  // 15: ermite.JobEnded.conclusion:type_name -> ermite.CiConclusion
+	1,  // 15: ermite.CompleteJobRequest.conclusion:type_name -> ermite.CiConclusion
-	19, // 16: ermite.AppendLogRequest.lines:type_name -> ermite.LogLine
+	39, // 16: ermite.CompleteJobRequest.outputs:type_name -> ermite.CompleteJobRequest.OutputsEntry
-	36, // 17: ermite.LogLine.time:type_name -> google.protobuf.Timestamp
+	15, // 17: ermite.CompleteJobRequest.steps:type_name -> ermite.StepUpdate
-	25, // 18: ermite.WatchJobResponse.keepalive:type_name -> ermite.Keepalive
+	29, // 18: ermite.CompleteJobRequest.annotations:type_name -> ermite.Annotation
-	26, // 19: ermite.WatchJobResponse.cancel:type_name -> ermite.CancelRequest
+	1,  // 19: ermite.CompleteJobResponse.conclusion:type_name -> ermite.CiConclusion
-	17, // 20: ermite.WatchJobResponse.ended:type_name -> ermite.JobEnded
+	1,  // 20: ermite.JobEnded.conclusion:type_name -> ermite.CiConclusion
-	4,  // 21: ermite.CancelRequest.reason:type_name -> ermite.CancelReason
+	21, // 21: ermite.AppendLogRequest.lines:type_name -> ermite.LogLine
-	36, // 22: ermite.CancelRequest.requested_at:type_name -> google.protobuf.Timestamp
+	41, // 22: ermite.LogLine.time:type_name -> google.protobuf.Timestamp
-	5,  // 23: ermite.Annotation.level:type_name -> ermite.AnnotationLevel
+	27, // 23: ermite.WatchJobResponse.keepalive:type_name -> ermite.Keepalive
-	28, // 24: ermite.ResolveActionsRequest.refs:type_name -> ermite.ActionRef
+	28, // 24: ermite.WatchJobResponse.cancel:type_name -> ermite.CancelRequest
-	31, // 25: ermite.ResolveActionsResponse.actions:type_name -> ermite.ResolvedAction
+	19, // 25: ermite.WatchJobResponse.ended:type_name -> ermite.JobEnded
-	6,  // 26: ermite.ResolvedAction.source:type_name -> ermite.ActionSource
+	4,  // 26: ermite.CancelRequest.reason:type_name -> ermite.CancelReason
-	7,  // 27: ermite.RunnerService.RegisterRunner:input_type -> ermite.RegisterRunnerRequest
+	41, // 27: ermite.CancelRequest.requested_at:type_name -> google.protobuf.Timestamp
-	9,  // 28: ermite.RunnerService.FetchJob:input_type -> ermite.FetchJobRequest
+	5,  // 28: ermite.Annotation.level:type_name -> ermite.AnnotationLevel
-	12, // 29: ermite.RunnerService.UpdateJob:input_type -> ermite.UpdateJobRequest
+	30, // 29: ermite.ResolveActionsRequest.refs:type_name -> ermite.ActionRef
-	18, // 30: ermite.RunnerService.AppendLog:input_type -> ermite.AppendLogRequest
+	33, // 30: ermite.ResolveActionsResponse.actions:type_name -> ermite.ResolvedAction
-	21, // 31: ermite.RunnerService.Heartbeat:input_type -> ermite.HeartbeatRequest
+	6,  // 31: ermite.ResolvedAction.source:type_name -> ermite.ActionSource
-	23, // 32: ermite.RunnerService.WatchJob:input_type -> ermite.WatchJobRequest
+	7,  // 32: ermite.RunnerService.RegisterRunner:input_type -> ermite.RegisterRunnerRequest
-	15, // 33: ermite.RunnerService.CompleteJob:input_type -> ermite.CompleteJobRequest
+	9,  // 33: ermite.RunnerService.FetchJob:input_type -> ermite.FetchJobRequest
-	29, // 34: ermite.RunnerService.ResolveActions:input_type -> ermite.ResolveActionsRequest
+	14, // 34: ermite.RunnerService.UpdateJob:input_type -> ermite.UpdateJobRequest
-	32, // 35: ermite.RunnerService.UploadSummary:input_type -> ermite.UploadSummaryRequest
+	20, // 35: ermite.RunnerService.AppendLog:input_type -> ermite.AppendLogRequest
-	8,  // 36: ermite.RunnerService.RegisterRunner:output_type -> ermite.RegisterRunnerResponse
+	23, // 36: ermite.RunnerService.Heartbeat:input_type -> ermite.HeartbeatRequest
-	10, // 37: ermite.RunnerService.FetchJob:output_type -> ermite.FetchJobResponse
+	25, // 37: ermite.RunnerService.WatchJob:input_type -> ermite.WatchJobRequest
-	14, // 38: ermite.RunnerService.UpdateJob:output_type -> ermite.UpdateJobResponse
+	17, // 38: ermite.RunnerService.CompleteJob:input_type -> ermite.CompleteJobRequest
-	20, // 39: ermite.RunnerService.AppendLog:output_type -> ermite.AppendLogResponse
+	31, // 39: ermite.RunnerService.ResolveActions:input_type -> ermite.ResolveActionsRequest
-	22, // 40: ermite.RunnerService.Heartbeat:output_type -> ermite.HeartbeatResponse
+	34, // 40: ermite.RunnerService.UploadSummary:input_type -> ermite.UploadSummaryRequest
-	24, // 41: ermite.RunnerService.WatchJob:output_type -> ermite.WatchJobResponse
+	8,  // 41: ermite.RunnerService.RegisterRunner:output_type -> ermite.RegisterRunnerResponse
-	16, // 42: ermite.RunnerService.CompleteJob:output_type -> ermite.CompleteJobResponse
+	10, // 42: ermite.RunnerService.FetchJob:output_type -> ermite.FetchJobResponse
-	30, // 43: ermite.RunnerService.ResolveActions:output_type -> ermite.ResolveActionsResponse
+	16, // 43: ermite.RunnerService.UpdateJob:output_type -> ermite.UpdateJobResponse
-	33, // 44: ermite.RunnerService.UploadSummary:output_type -> ermite.UploadSummaryResponse
+	22, // 44: ermite.RunnerService.AppendLog:output_type -> ermite.AppendLogResponse
-	36, // [36:45] is the sub-list for method output_type
+	24, // 45: ermite.RunnerService.Heartbeat:output_type -> ermite.HeartbeatResponse
-	27, // [27:36] is the sub-list for method input_type
+	26, // 46: ermite.RunnerService.WatchJob:output_type -> ermite.WatchJobResponse
-	27, // [27:27] is the sub-list for extension type_name
+	18, // 47: ermite.RunnerService.CompleteJob:output_type -> ermite.CompleteJobResponse
-	27, // [27:27] is the sub-list for extension extendee
+	32, // 48: ermite.RunnerService.ResolveActions:output_type -> ermite.ResolveActionsResponse
-	0,  // [0:27] is the sub-list for field type_name
+	35, // 49: ermite.RunnerService.UploadSummary:output_type -> ermite.UploadSummaryResponse
+	41, // [41:50] is the sub-list for method output_type
+	32, // [32:41] is the sub-list for method input_type
+	32, // [32:32] is the sub-list for extension type_name
+	32, // [32:32] is the sub-list for extension extendee
+	0,  // [0:32] is the sub-list for field type_name
 }
 func init() { file_ermite_runner_proto_init() }
 	if File_ermite_runner_proto != nil {
 		return
 	}
-	file_ermite_runner_proto_msgTypes[17].OneofWrappers = []any{
+	file_ermite_runner_proto_msgTypes[19].OneofWrappers = []any{
 		(*WatchJobResponse_Keepalive)(nil),
 		(*WatchJobResponse_Cancel)(nil),
 		(*WatchJobResponse_Ended)(nil),
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ermite_runner_proto_rawDesc), len(file_ermite_runner_proto_rawDesc)),
 			NumEnums:      7,
-			NumMessages:   28,
+			NumMessages:   33,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

M gen/ermite/server.pb.go +5 -1 generated file: collapsed

load diff

M gen/ermite/token.pb.go +4 -2 generated file: collapsed

load diff

M gen_test.go +89 -0


@@ -64,9 +64,20 @@ func TestProcedures(t *testing.T) {
64	64		{ermiteconnect.RunServiceGetStepSummariesProcedure, "/ermite.RunService/GetStepSummaries"},
65	65		{ermiteconnect.RunServiceCancelRunProcedure, "/ermite.RunService/CancelRun"},
66	66		{ermiteconnect.RunServiceRerunRunProcedure, "/ermite.RunService/RerunRun"},
	67	+	{ermiteconnect.RunServiceDispatchWorkflowProcedure, "/ermite.RunService/DispatchWorkflow"},
67	68		{ermiteconnect.RunServiceListChecksProcedure, "/ermite.RunService/ListChecks"},
68	69		{ermiteconnect.RunServiceListRunnersProcedure, "/ermite.RunService/ListRunners"},
69	70		{ermiteconnect.RunServiceRemoveRunnerProcedure, "/ermite.RunService/RemoveRunner"},
	71	+	{ermiteconnect.SecretServiceSetSecretProcedure, "/ermite.SecretService/SetSecret"},
	72	+	{ermiteconnect.SecretServiceListSecretsProcedure, "/ermite.SecretService/ListSecrets"},
	73	+	{ermiteconnect.SecretServiceDeleteSecretProcedure, "/ermite.SecretService/DeleteSecret"},
	74	+	{ermiteconnect.VariableServiceSetVariableProcedure, "/ermite.VariableService/SetVariable"},
	75	+	{ermiteconnect.VariableServiceGetVariableProcedure, "/ermite.VariableService/GetVariable"},
	76	+	{ermiteconnect.VariableServiceListVariablesProcedure, "/ermite.VariableService/ListVariables"},
	77	+	{ermiteconnect.VariableServiceDeleteVariableProcedure, "/ermite.VariableService/DeleteVariable"},
	78	+	{ermiteconnect.EnvironmentServiceCreateEnvironmentProcedure, "/ermite.EnvironmentService/CreateEnvironment"},
	79	+	{ermiteconnect.EnvironmentServiceListEnvironmentsProcedure, "/ermite.EnvironmentService/ListEnvironments"},
	80	+	{ermiteconnect.EnvironmentServiceDeleteEnvironmentProcedure, "/ermite.EnvironmentService/DeleteEnvironment"},
70	81		}
71	82		for _, tt := range tests {
72	83		if tt.got != tt.want {

@@ -104,6 +115,7 @@ func TestEnumNumbers(t *testing.T) {
104	115		{"CI_STATUS_QUEUED", int32(ermite.CiStatus_CI_STATUS_QUEUED), 1},
105	116		{"CI_STATUS_IN_PROGRESS", int32(ermite.CiStatus_CI_STATUS_IN_PROGRESS), 2},
106	117		{"CI_STATUS_COMPLETED", int32(ermite.CiStatus_CI_STATUS_COMPLETED), 3},
	118	+	{"CI_STATUS_PENDING", int32(ermite.CiStatus_CI_STATUS_PENDING), 4},
107	119		{"CI_CONCLUSION_UNSPECIFIED", int32(ermite.CiConclusion_CI_CONCLUSION_UNSPECIFIED), 0},
108	120		{"CI_CONCLUSION_SUCCESS", int32(ermite.CiConclusion_CI_CONCLUSION_SUCCESS), 1},
109	121		{"CI_CONCLUSION_FAILURE", int32(ermite.CiConclusion_CI_CONCLUSION_FAILURE), 2},

@@ -450,3 +462,80 @@ func TestCI2RoundTrip(t *testing.T) {
450	462		}
451	463		}
452	464		}
	465	+
	466	+	// TestCI3FieldNumbers pins the numbers of the fields added for CI-3.
	467	+	func TestCI3FieldNumbers(t *testing.T) {
	468	+	tests := []struct {
	469	+	msg proto.Message
	470	+	fields map[string]int
	471	+	}{
	472	+	{&ermite.Job{}, map[string]int{
	473	+	"secrets": 16, "vars": 17, "environment": 18, "permissions": 19, "cache": 20, "trusted": 21,
	474	+	}},
	475	+	{&ermite.JobPermissions{}, map[string]int{"levels": 1}},
	476	+	{&ermite.JobCache{}, map[string]int{"repository": 1, "write_ref": 2, "read_refs": 3}},
	477	+	{&ermite.Run{}, map[string]int{"trusted": 20}},
	478	+	{&ermite.RunJob{}, map[string]int{"concurrency_group": 20}},
	479	+	{&ermite.DispatchWorkflowRequest{}, map[string]int{"repo": 1, "workflow_path": 2, "ref": 3, "inputs": 4}},
	480	+	{&ermite.DispatchWorkflowResponse{}, map[string]int{"run": 1}},
	481	+	{&ermite.SettingsScope{}, map[string]int{"instance": 1, "repo": 2, "environment": 3}},
	482	+	{&ermite.EnvironmentRef{}, map[string]int{"repo": 1, "name": 2}},
	483	+	{&ermite.Secret{}, map[string]int{"name": 1, "updated_at": 2}},
	484	+	{&ermite.Variable{}, map[string]int{"name": 1, "value": 2, "updated_at": 3}},
	485	+	{&ermite.Environment{}, map[string]int{"repo": 1, "name": 2, "created_at": 3}},
	486	+	{&ermite.SetSecretRequest{}, map[string]int{"scope": 1, "name": 2, "value": 3}},
	487	+	{&ermite.ListSecretsRequest{}, map[string]int{"scope": 1, "page_size": 2, "page_token": 3}},
	488	+	{&ermite.ListSecretsResponse{}, map[string]int{"secrets": 1, "next_page_token": 2}},
	489	+	{&ermite.ListVariablesResponse{}, map[string]int{"variables": 1, "next_page_token": 2}},
	490	+	{&ermite.ListEnvironmentsRequest{}, map[string]int{"repo": 1, "page_size": 2, "page_token": 3}},
	491	+	{&ermite.ListEnvironmentsResponse{}, map[string]int{"environments": 1, "next_page_token": 2}},
	492	+	}
	493	+	for _, tt := range tests {
	494	+	md := tt.msg.ProtoReflect().Descriptor()
	495	+	for name, num := range tt.fields {
	496	+	if fd := md.Fields().ByName(protoreflect.Name(name)); fd == nil \|\| int(fd.Number()) != num {
	497	+	t.Errorf("%s.%s: %v, want number %d", md.Name(), name, fd, num)
	498	+	}
	499	+	}
	500	+	}
	501	+	}
	502	+
	503	+	// TestCI3RoundTrip checks that the CI-3 messages survive the wire.
	504	+	func TestCI3RoundTrip(t *testing.T) {
	505	+	msgs := []proto.Message{
	506	+	&ermite.Job{
	507	+	JobId: "j1", Secrets: map[string]string{"TOKEN": "s3cret"}, Vars: map[string]string{"REGION": "eu"},
	508	+	Environment: "staging", Trusted: true,
	509	+	Permissions: &ermite.JobPermissions{Levels: map[string]string{"contents": "write", "packages": "none"}},
	510	+	Cache: &ermite.JobCache{
	511	+	Repository: "ermite", WriteRef: "refs/pull/7/merge",
	512	+	ReadRefs: []string{"refs/pull/7/merge", "refs/heads/main"},
	513	+	},
	514	+	},
	515	+	&ermite.Run{Id: 9, Event: "workflow_dispatch", Trusted: true},
	516	+	&ermite.RunJob{Id: "j1", Status: ermite.CiStatus_CI_STATUS_PENDING, ConcurrencyGroup: "deploy"},
	517	+	&ermite.DispatchWorkflowRequest{Repo: "ermite", WorkflowPath: "ci.yml", Ref: "main", Inputs: map[string]string{"debug": "true"}},
	518	+	&ermite.DispatchWorkflowResponse{Run: &ermite.Run{Id: 9, Event: "workflow_dispatch"}},
	519	+	&ermite.SetSecretRequest{Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Instance{Instance: true}}, Name: "A", Value: "v"},
	520	+	&ermite.SetSecretRequest{Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Repo{Repo: "ermite"}}, Name: "A", Value: "v"},
	521	+	&ermite.SetVariableRequest{
	522	+	Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Environment{Environment: &ermite.EnvironmentRef{Repo: "ermite", Name: "prod"}}},
	523	+	Name: "A", Value: "v",
	524	+	},
	525	+	&ermite.ListSecretsResponse{Secrets: []*ermite.Secret{{Name: "A"}}, NextPageToken: "t"},
	526	+	&ermite.ListEnvironmentsResponse{Environments: []*ermite.Environment{{Repo: "ermite", Name: "prod"}}},
	527	+	}
	528	+	for _, in := range msgs {
	529	+	b, err := proto.Marshal(in)
	530	+	if err != nil {
	531	+	t.Fatal(err)
	532	+	}
	533	+	out := in.ProtoReflect().New().Interface()
	534	+	if err := proto.Unmarshal(b, out); err != nil {
	535	+	t.Fatal(err)
	536	+	}
	537	+	if !proto.Equal(in, out) {
	538	+	t.Errorf("%T: round trip mismatch: %v != %v", in, out, in)
	539	+	}
	540	+	}
	541	+	}


@@ -64,9 +64,20 @@ func TestProcedures(t *testing.T) {
64	{ermiteconnect.RunServiceGetStepSummariesProcedure, "/ermite.RunService/GetStepSummaries"},	64		{ermiteconnect.RunServiceGetStepSummariesProcedure, "/ermite.RunService/GetStepSummaries"},
65	{ermiteconnect.RunServiceCancelRunProcedure, "/ermite.RunService/CancelRun"},	65		{ermiteconnect.RunServiceCancelRunProcedure, "/ermite.RunService/CancelRun"},
66	{ermiteconnect.RunServiceRerunRunProcedure, "/ermite.RunService/RerunRun"},	66		{ermiteconnect.RunServiceRerunRunProcedure, "/ermite.RunService/RerunRun"},
		67	+	{ermiteconnect.RunServiceDispatchWorkflowProcedure, "/ermite.RunService/DispatchWorkflow"},
67	{ermiteconnect.RunServiceListChecksProcedure, "/ermite.RunService/ListChecks"},	68		{ermiteconnect.RunServiceListChecksProcedure, "/ermite.RunService/ListChecks"},
68	{ermiteconnect.RunServiceListRunnersProcedure, "/ermite.RunService/ListRunners"},	69		{ermiteconnect.RunServiceListRunnersProcedure, "/ermite.RunService/ListRunners"},
69	{ermiteconnect.RunServiceRemoveRunnerProcedure, "/ermite.RunService/RemoveRunner"},	70		{ermiteconnect.RunServiceRemoveRunnerProcedure, "/ermite.RunService/RemoveRunner"},
		71	+	{ermiteconnect.SecretServiceSetSecretProcedure, "/ermite.SecretService/SetSecret"},
		72	+	{ermiteconnect.SecretServiceListSecretsProcedure, "/ermite.SecretService/ListSecrets"},
		73	+	{ermiteconnect.SecretServiceDeleteSecretProcedure, "/ermite.SecretService/DeleteSecret"},
		74	+	{ermiteconnect.VariableServiceSetVariableProcedure, "/ermite.VariableService/SetVariable"},
		75	+	{ermiteconnect.VariableServiceGetVariableProcedure, "/ermite.VariableService/GetVariable"},
		76	+	{ermiteconnect.VariableServiceListVariablesProcedure, "/ermite.VariableService/ListVariables"},
		77	+	{ermiteconnect.VariableServiceDeleteVariableProcedure, "/ermite.VariableService/DeleteVariable"},
		78	+	{ermiteconnect.EnvironmentServiceCreateEnvironmentProcedure, "/ermite.EnvironmentService/CreateEnvironment"},
		79	+	{ermiteconnect.EnvironmentServiceListEnvironmentsProcedure, "/ermite.EnvironmentService/ListEnvironments"},
		80	+	{ermiteconnect.EnvironmentServiceDeleteEnvironmentProcedure, "/ermite.EnvironmentService/DeleteEnvironment"},
70	}	81		}
71	for _, tt := range tests {	82		for _, tt := range tests {
72	if tt.got != tt.want {	83		if tt.got != tt.want {

@@ -104,6 +115,7 @@ func TestEnumNumbers(t *testing.T) {
104	{"CI_STATUS_QUEUED", int32(ermite.CiStatus_CI_STATUS_QUEUED), 1},	115		{"CI_STATUS_QUEUED", int32(ermite.CiStatus_CI_STATUS_QUEUED), 1},
105	{"CI_STATUS_IN_PROGRESS", int32(ermite.CiStatus_CI_STATUS_IN_PROGRESS), 2},	116		{"CI_STATUS_IN_PROGRESS", int32(ermite.CiStatus_CI_STATUS_IN_PROGRESS), 2},
106	{"CI_STATUS_COMPLETED", int32(ermite.CiStatus_CI_STATUS_COMPLETED), 3},	117		{"CI_STATUS_COMPLETED", int32(ermite.CiStatus_CI_STATUS_COMPLETED), 3},
		118	+	{"CI_STATUS_PENDING", int32(ermite.CiStatus_CI_STATUS_PENDING), 4},
107	{"CI_CONCLUSION_UNSPECIFIED", int32(ermite.CiConclusion_CI_CONCLUSION_UNSPECIFIED), 0},	119		{"CI_CONCLUSION_UNSPECIFIED", int32(ermite.CiConclusion_CI_CONCLUSION_UNSPECIFIED), 0},
108	{"CI_CONCLUSION_SUCCESS", int32(ermite.CiConclusion_CI_CONCLUSION_SUCCESS), 1},	120		{"CI_CONCLUSION_SUCCESS", int32(ermite.CiConclusion_CI_CONCLUSION_SUCCESS), 1},
109	{"CI_CONCLUSION_FAILURE", int32(ermite.CiConclusion_CI_CONCLUSION_FAILURE), 2},	121		{"CI_CONCLUSION_FAILURE", int32(ermite.CiConclusion_CI_CONCLUSION_FAILURE), 2},

@@ -450,3 +462,80 @@ func TestCI2RoundTrip(t *testing.T) {
450	}	462		}
451	}	463		}
452	}	464		}
		465	+
		466	+	// TestCI3FieldNumbers pins the numbers of the fields added for CI-3.
		467	+	func TestCI3FieldNumbers(t *testing.T) {
		468	+	tests := []struct {
		469	+	msg proto.Message
		470	+	fields map[string]int
		471	+	}{
		472	+	{&ermite.Job{}, map[string]int{
		473	+	"secrets": 16, "vars": 17, "environment": 18, "permissions": 19, "cache": 20, "trusted": 21,
		474	+	}},
		475	+	{&ermite.JobPermissions{}, map[string]int{"levels": 1}},
		476	+	{&ermite.JobCache{}, map[string]int{"repository": 1, "write_ref": 2, "read_refs": 3}},
		477	+	{&ermite.Run{}, map[string]int{"trusted": 20}},
		478	+	{&ermite.RunJob{}, map[string]int{"concurrency_group": 20}},
		479	+	{&ermite.DispatchWorkflowRequest{}, map[string]int{"repo": 1, "workflow_path": 2, "ref": 3, "inputs": 4}},
		480	+	{&ermite.DispatchWorkflowResponse{}, map[string]int{"run": 1}},
		481	+	{&ermite.SettingsScope{}, map[string]int{"instance": 1, "repo": 2, "environment": 3}},
		482	+	{&ermite.EnvironmentRef{}, map[string]int{"repo": 1, "name": 2}},
		483	+	{&ermite.Secret{}, map[string]int{"name": 1, "updated_at": 2}},
		484	+	{&ermite.Variable{}, map[string]int{"name": 1, "value": 2, "updated_at": 3}},
		485	+	{&ermite.Environment{}, map[string]int{"repo": 1, "name": 2, "created_at": 3}},
		486	+	{&ermite.SetSecretRequest{}, map[string]int{"scope": 1, "name": 2, "value": 3}},
		487	+	{&ermite.ListSecretsRequest{}, map[string]int{"scope": 1, "page_size": 2, "page_token": 3}},
		488	+	{&ermite.ListSecretsResponse{}, map[string]int{"secrets": 1, "next_page_token": 2}},
		489	+	{&ermite.ListVariablesResponse{}, map[string]int{"variables": 1, "next_page_token": 2}},
		490	+	{&ermite.ListEnvironmentsRequest{}, map[string]int{"repo": 1, "page_size": 2, "page_token": 3}},
		491	+	{&ermite.ListEnvironmentsResponse{}, map[string]int{"environments": 1, "next_page_token": 2}},
		492	+	}
		493	+	for _, tt := range tests {
		494	+	md := tt.msg.ProtoReflect().Descriptor()
		495	+	for name, num := range tt.fields {
		496	+	if fd := md.Fields().ByName(protoreflect.Name(name)); fd == nil \|\| int(fd.Number()) != num {
		497	+	t.Errorf("%s.%s: %v, want number %d", md.Name(), name, fd, num)
		498	+	}
		499	+	}
		500	+	}
		501	+	}
		502	+
		503	+	// TestCI3RoundTrip checks that the CI-3 messages survive the wire.
		504	+	func TestCI3RoundTrip(t *testing.T) {
		505	+	msgs := []proto.Message{
		506	+	&ermite.Job{
		507	+	JobId: "j1", Secrets: map[string]string{"TOKEN": "s3cret"}, Vars: map[string]string{"REGION": "eu"},
		508	+	Environment: "staging", Trusted: true,
		509	+	Permissions: &ermite.JobPermissions{Levels: map[string]string{"contents": "write", "packages": "none"}},
		510	+	Cache: &ermite.JobCache{
		511	+	Repository: "ermite", WriteRef: "refs/pull/7/merge",
		512	+	ReadRefs: []string{"refs/pull/7/merge", "refs/heads/main"},
		513	+	},
		514	+	},
		515	+	&ermite.Run{Id: 9, Event: "workflow_dispatch", Trusted: true},
		516	+	&ermite.RunJob{Id: "j1", Status: ermite.CiStatus_CI_STATUS_PENDING, ConcurrencyGroup: "deploy"},
		517	+	&ermite.DispatchWorkflowRequest{Repo: "ermite", WorkflowPath: "ci.yml", Ref: "main", Inputs: map[string]string{"debug": "true"}},
		518	+	&ermite.DispatchWorkflowResponse{Run: &ermite.Run{Id: 9, Event: "workflow_dispatch"}},
		519	+	&ermite.SetSecretRequest{Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Instance{Instance: true}}, Name: "A", Value: "v"},
		520	+	&ermite.SetSecretRequest{Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Repo{Repo: "ermite"}}, Name: "A", Value: "v"},
		521	+	&ermite.SetVariableRequest{
		522	+	Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Environment{Environment: &ermite.EnvironmentRef{Repo: "ermite", Name: "prod"}}},
		523	+	Name: "A", Value: "v",
		524	+	},
		525	+	&ermite.ListSecretsResponse{Secrets: []*ermite.Secret{{Name: "A"}}, NextPageToken: "t"},
		526	+	&ermite.ListEnvironmentsResponse{Environments: []*ermite.Environment{{Repo: "ermite", Name: "prod"}}},
		527	+	}
		528	+	for _, in := range msgs {
		529	+	b, err := proto.Marshal(in)
		530	+	if err != nil {
		531	+	t.Fatal(err)
		532	+	}
		533	+	out := in.ProtoReflect().New().Interface()
		534	+	if err := proto.Unmarshal(b, out); err != nil {
		535	+	t.Fatal(err)
		536	+	}
		537	+	if !proto.Equal(in, out) {
		538	+	t.Errorf("%T: round trip mismatch: %v != %v", in, out, in)
		539	+	}
		540	+	}
		541	+	}

A proto/ermite/ci_settings.proto +297 -0

@@ -0,0 +1,297 @@
	1	+	// SPDX-License-Identifier: MIT
	2	+
	3	+	syntax = "proto3";
	4	+
	5	+	package ermite;
	6	+
	7	+	import "google/protobuf/timestamp.proto";
	8	+
	9	+	// SettingsScope says where a secret or a variable lives, like the scopes of
	10	+	// GitHub Actions. A job sees the ones of its instance, its repository and its
	11	+	// environment, and the narrowest scope wins: environment over repository over
	12	+	// instance.
	13	+	message SettingsScope {
	14	+	// Where is the scope. It is required: a request without it is
	15	+	// invalid_argument.
	16	+	oneof where {
	17	+	// Instance is the whole server. It must be true when set. It needs a token
	18	+	// that is not restricted to repositories, or the root token.
	19	+	bool instance = 1;
	20	+	// Repo is the name of a repository.
	21	+	string repo = 2;
	22	+	// Environment is an environment of a repository.
	23	+	EnvironmentRef environment = 3;
	24	+	}
	25	+	}
	26	+
	27	+	// EnvironmentRef names an environment of a repository.
	28	+	message EnvironmentRef {
	29	+	// Repo is the repository name.
	30	+	string repo = 1;
	31	+	// Name is the environment name, see Environment.name.
	32	+	string name = 2;
	33	+	}
	34	+
	35	+	// Secret describes a stored secret. It never contains the value: a value can
	36	+	// be set but not read back.
	37	+	message Secret {
	38	+	// Name is the name of the secret, in upper case as the server stores it.
	39	+	string name = 1;
	40	+	// UpdatedAt is when the value was last set.
	41	+	google.protobuf.Timestamp updated_at = 2;
	42	+	}
	43	+
	44	+	// Variable is a configuration variable. Unlike a secret its value can be read
	45	+	// back and it may appear in logs.
	46	+	message Variable {
	47	+	// Name is the name of the variable, in upper case as the server stores it.
	48	+	string name = 1;
	49	+	// Value is the value, at most 48 KiB.
	50	+	string value = 2;
	51	+	// UpdatedAt is when the value was last set.
	52	+	google.protobuf.Timestamp updated_at = 3;
	53	+	}
	54	+
	55	+	// Environment is a named deployment target of a repository, to which secrets
	56	+	// and variables can be attached. A workflow job that names an environment
	57	+	// creates it on first use, as on GitHub.
	58	+	message Environment {
	59	+	// Repo is the repository name.
	60	+	string repo = 1;
	61	+	// Name is the name of the environment, 1 to 255 characters without control
	62	+	// characters, unique in the repository without regard to case. The server
	63	+	// keeps the case it was given.
	64	+	string name = 2;
	65	+	// CreatedAt is when the environment was created.
	66	+	google.protobuf.Timestamp created_at = 3;
	67	+	}
	68	+
	69	+	// SecretService manages the encrypted secrets that CI jobs receive, like `gh
	70	+	// secret` does on GitHub. Names are 1 to 255 characters among letters, digits
	71	+	// and "_", do not begin with a digit or with "GITHUB_", and are
	72	+	// case-insensitive: the server stores them in upper case.
	73	+	//
	74	+	// Every RPC needs the secrets:write scope on a token that may access the
	75	+	// repository of the scope (a repository-restricted token cannot use the
	76	+	// instance scope), or the root token. Tokens limited to branches are refused
	77	+	// with permission_denied, whatever their scopes: they never hold the owner's
	78	+	// rights. A repository that does not exist or that the caller cannot access
	79	+	// gives not_found.
	80	+	//
	81	+	// Values are encrypted at rest with the server's key. A server without a key
	82	+	// refuses to set a secret with failed_precondition and sends no secrets to
	83	+	// jobs. The API never returns a value, and the server never logs one.
	84	+	//
	85	+	// Page sizes and page tokens work as in the other services.
	86	+	//
	87	+	// Servers that implement it list "ci.secrets" in GetVersionResponse.features.
	88	+	service SecretService {
	89	+	// SetSecret creates the secret or replaces its value. Fails with
	90	+	// invalid_argument if the name is not valid, if the value is empty or longer
	91	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	92	+	// environment of the scope does not exist, and with failed_precondition if
	93	+	// the server has no encryption key.
	94	+	rpc SetSecret(SetSecretRequest) returns (SetSecretResponse);
	95	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	96	+	// the secrets set in that scope, not the ones the scope inherits. It never
	97	+	// returns values.
	98	+	rpc ListSecrets(ListSecretsRequest) returns (ListSecretsResponse);
	99	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	100	+	rpc DeleteSecret(DeleteSecretRequest) returns (DeleteSecretResponse);
	101	+	}
	102	+
	103	+	// SetSecretRequest names a secret and gives its value.
	104	+	message SetSecretRequest {
	105	+	// Scope is where the secret lives.
	106	+	SettingsScope scope = 1;
	107	+	// Name is the name of the secret.
	108	+	string name = 2;
	109	+	// Value is the value in plain text, 1 byte to 48 KiB. It may contain
	110	+	// several lines.
	111	+	string value = 3;
	112	+	}
	113	+
	114	+	// SetSecretResponse describes the stored secret.
	115	+	message SetSecretResponse {
	116	+	// Secret is the secret, without its value.
	117	+	Secret secret = 1;
	118	+	}
	119	+
	120	+	// ListSecretsRequest selects a page of the secrets of a scope.
	121	+	message ListSecretsRequest {
	122	+	// Scope is the scope to list.
	123	+	SettingsScope scope = 1;
	124	+	// PageSize is the maximum number of secrets to return. 0 means the server
	125	+	// default; values above the server maximum are lowered to it.
	126	+	int32 page_size = 2;
	127	+	// PageToken is the next_page_token of a previous response. Empty for the
	128	+	// first page.
	129	+	string page_token = 3;
	130	+	}
	131	+
	132	+	// ListSecretsResponse is one page of secrets.
	133	+	message ListSecretsResponse {
	134	+	// Secrets are the secrets of this page, ordered by name, without values.
	135	+	repeated Secret secrets = 1;
	136	+	// NextPageToken is passed as page_token to get the next page. Empty when
	137	+	// there is no next page.
	138	+	string next_page_token = 2;
	139	+	}
	140	+
	141	+	// DeleteSecretRequest names the secret to delete.
	142	+	message DeleteSecretRequest {
	143	+	// Scope is where the secret lives.
	144	+	SettingsScope scope = 1;
	145	+	// Name is the name of the secret, without regard to case.
	146	+	string name = 2;
	147	+	}
	148	+
	149	+	// DeleteSecretResponse is empty.
	150	+	message DeleteSecretResponse {}
	151	+
	152	+	// VariableService manages the configuration variables that CI jobs receive in
	153	+	// the "vars" context, like `gh variable` does on GitHub. Names follow the
	154	+	// rules of SecretService. Access rules, errors and page handling are those of
	155	+	// SecretService, and the same servers (feature "ci.secrets") implement it.
	156	+	service VariableService {
	157	+	// SetVariable creates the variable or replaces its value. Fails with
	158	+	// invalid_argument if the name is not valid, if the value is longer than 48
	159	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	160	+	// environment of the scope does not exist. An empty value is allowed.
	161	+	rpc SetVariable(SetVariableRequest) returns (SetVariableResponse);
	162	+	// GetVariable returns one variable of one scope, with its value. Fails with
	163	+	// not_found if it does not exist in that scope.
	164	+	rpc GetVariable(GetVariableRequest) returns (GetVariableResponse);
	165	+	// ListVariables lists the variables of one scope, ordered by name, with
	166	+	// their values. It lists only the variables set in that scope.
	167	+	rpc ListVariables(ListVariablesRequest) returns (ListVariablesResponse);
	168	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	169	+	// exist.
	170	+	rpc DeleteVariable(DeleteVariableRequest) returns (DeleteVariableResponse);
	171	+	}
	172	+
	173	+	// SetVariableRequest names a variable and gives its value.
	174	+	message SetVariableRequest {
	175	+	// Scope is where the variable lives.
	176	+	SettingsScope scope = 1;
	177	+	// Name is the name of the variable.
	178	+	string name = 2;
	179	+	// Value is the value, at most 48 KiB.
	180	+	string value = 3;
	181	+	}
	182	+
	183	+	// SetVariableResponse holds the stored variable.
	184	+	message SetVariableResponse {
	185	+	// Variable is the variable as stored.
	186	+	Variable variable = 1;
	187	+	}
	188	+
	189	+	// GetVariableRequest names a variable.
	190	+	message GetVariableRequest {
	191	+	// Scope is where the variable lives.
	192	+	SettingsScope scope = 1;
	193	+	// Name is the name of the variable, without regard to case.
	194	+	string name = 2;
	195	+	}
	196	+
	197	+	// GetVariableResponse holds a variable.
	198	+	message GetVariableResponse {
	199	+	// Variable is the variable.
	200	+	Variable variable = 1;
	201	+	}
	202	+
	203	+	// ListVariablesRequest selects a page of the variables of a scope.
	204	+	message ListVariablesRequest {
	205	+	// Scope is the scope to list.
	206	+	SettingsScope scope = 1;
	207	+	// PageSize is the maximum number of variables to return. 0 means the server
	208	+	// default; values above the server maximum are lowered to it.
	209	+	int32 page_size = 2;
	210	+	// PageToken is the next_page_token of a previous response. Empty for the
	211	+	// first page.
	212	+	string page_token = 3;
	213	+	}
	214	+
	215	+	// ListVariablesResponse is one page of variables.
	216	+	message ListVariablesResponse {
	217	+	// Variables are the variables of this page, ordered by name.
	218	+	repeated Variable variables = 1;
	219	+	// NextPageToken is passed as page_token to get the next page. Empty when
	220	+	// there is no next page.
	221	+	string next_page_token = 2;
	222	+	}
	223	+
	224	+	// DeleteVariableRequest names the variable to delete.
	225	+	message DeleteVariableRequest {
	226	+	// Scope is where the variable lives.
	227	+	SettingsScope scope = 1;
	228	+	// Name is the name of the variable, without regard to case.
	229	+	string name = 2;
	230	+	}
	231	+
	232	+	// DeleteVariableResponse is empty.
	233	+	message DeleteVariableResponse {}
	234	+
	235	+	// EnvironmentService manages the environments of a repository, to which
	236	+	// secrets and variables are attached. Environments have no protection rules
	237	+	// and no deployments. Access rules and errors are those of SecretService (the
	238	+	// secrets:write scope, no token limited to branches), and the same servers
	239	+	// (feature "ci.secrets") implement it.
	240	+	service EnvironmentService {
	241	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	242	+	// if the environment already exists (without regard to case), as GitHub's
	243	+	// create-or-update does. Fails with invalid_argument if the name is not
	244	+	// valid and with not_found if the repository does not exist.
	245	+	rpc CreateEnvironment(CreateEnvironmentRequest) returns (CreateEnvironmentResponse);
	246	+	// ListEnvironments lists the environments of a repository, ordered by name.
	247	+	rpc ListEnvironments(ListEnvironmentsRequest) returns (ListEnvironmentsResponse);
	248	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	249	+	// Fails with not_found if it does not exist.
	250	+	rpc DeleteEnvironment(DeleteEnvironmentRequest) returns (DeleteEnvironmentResponse);
	251	+	}
	252	+
	253	+	// CreateEnvironmentRequest names the environment to create.
	254	+	message CreateEnvironmentRequest {
	255	+	// Repo is the repository name.
	256	+	string repo = 1;
	257	+	// Name is the name of the environment, see Environment.name.
	258	+	string name = 2;
	259	+	}
	260	+
	261	+	// CreateEnvironmentResponse holds the environment.
	262	+	message CreateEnvironmentResponse {
	263	+	// Environment is the environment, new or existing.
	264	+	Environment environment = 1;
	265	+	}
	266	+
	267	+	// ListEnvironmentsRequest selects a page of the environments of a repository.
	268	+	message ListEnvironmentsRequest {
	269	+	// Repo is the repository name.
	270	+	string repo = 1;
	271	+	// PageSize is the maximum number of environments to return. 0 means the
	272	+	// server default; values above the server maximum are lowered to it.
	273	+	int32 page_size = 2;
	274	+	// PageToken is the next_page_token of a previous response. Empty for the
	275	+	// first page.
	276	+	string page_token = 3;
	277	+	}
	278	+
	279	+	// ListEnvironmentsResponse is one page of environments.
	280	+	message ListEnvironmentsResponse {
	281	+	// Environments are the environments of this page, ordered by name.
	282	+	repeated Environment environments = 1;
	283	+	// NextPageToken is passed as page_token to get the next page. Empty when
	284	+	// there is no next page.
	285	+	string next_page_token = 2;
	286	+	}
	287	+
	288	+	// DeleteEnvironmentRequest names the environment to delete.
	289	+	message DeleteEnvironmentRequest {
	290	+	// Repo is the repository name.
	291	+	string repo = 1;
	292	+	// Name is the name of the environment, without regard to case.
	293	+	string name = 2;
	294	+	}
	295	+
	296	+	// DeleteEnvironmentResponse is empty.
	297	+	message DeleteEnvironmentResponse {}

@@ -0,0 +1,297 @@
	1	+	// SPDX-License-Identifier: MIT
	2	+
	3	+	syntax = "proto3";
	4	+
	5	+	package ermite;
	6	+
	7	+	import "google/protobuf/timestamp.proto";
	8	+
	9	+	// SettingsScope says where a secret or a variable lives, like the scopes of
	10	+	// GitHub Actions. A job sees the ones of its instance, its repository and its
	11	+	// environment, and the narrowest scope wins: environment over repository over
	12	+	// instance.
	13	+	message SettingsScope {
	14	+	// Where is the scope. It is required: a request without it is
	15	+	// invalid_argument.
	16	+	oneof where {
	17	+	// Instance is the whole server. It must be true when set. It needs a token
	18	+	// that is not restricted to repositories, or the root token.
	19	+	bool instance = 1;
	20	+	// Repo is the name of a repository.
	21	+	string repo = 2;
	22	+	// Environment is an environment of a repository.
	23	+	EnvironmentRef environment = 3;
	24	+	}
	25	+	}
	26	+
	27	+	// EnvironmentRef names an environment of a repository.
	28	+	message EnvironmentRef {
	29	+	// Repo is the repository name.
	30	+	string repo = 1;
	31	+	// Name is the environment name, see Environment.name.
	32	+	string name = 2;
	33	+	}
	34	+
	35	+	// Secret describes a stored secret. It never contains the value: a value can
	36	+	// be set but not read back.
	37	+	message Secret {
	38	+	// Name is the name of the secret, in upper case as the server stores it.
	39	+	string name = 1;
	40	+	// UpdatedAt is when the value was last set.
	41	+	google.protobuf.Timestamp updated_at = 2;
	42	+	}
	43	+
	44	+	// Variable is a configuration variable. Unlike a secret its value can be read
	45	+	// back and it may appear in logs.
	46	+	message Variable {
	47	+	// Name is the name of the variable, in upper case as the server stores it.
	48	+	string name = 1;
	49	+	// Value is the value, at most 48 KiB.
	50	+	string value = 2;
	51	+	// UpdatedAt is when the value was last set.
	52	+	google.protobuf.Timestamp updated_at = 3;
	53	+	}
	54	+
	55	+	// Environment is a named deployment target of a repository, to which secrets
	56	+	// and variables can be attached. A workflow job that names an environment
	57	+	// creates it on first use, as on GitHub.
	58	+	message Environment {
	59	+	// Repo is the repository name.
	60	+	string repo = 1;
	61	+	// Name is the name of the environment, 1 to 255 characters without control
	62	+	// characters, unique in the repository without regard to case. The server
	63	+	// keeps the case it was given.
	64	+	string name = 2;
	65	+	// CreatedAt is when the environment was created.
	66	+	google.protobuf.Timestamp created_at = 3;
	67	+	}
	68	+
	69	+	// SecretService manages the encrypted secrets that CI jobs receive, like `gh
	70	+	// secret` does on GitHub. Names are 1 to 255 characters among letters, digits
	71	+	// and "_", do not begin with a digit or with "GITHUB_", and are
	72	+	// case-insensitive: the server stores them in upper case.
	73	+	//
	74	+	// Every RPC needs the secrets:write scope on a token that may access the
	75	+	// repository of the scope (a repository-restricted token cannot use the
	76	+	// instance scope), or the root token. Tokens limited to branches are refused
	77	+	// with permission_denied, whatever their scopes: they never hold the owner's
	78	+	// rights. A repository that does not exist or that the caller cannot access
	79	+	// gives not_found.
	80	+	//
	81	+	// Values are encrypted at rest with the server's key. A server without a key
	82	+	// refuses to set a secret with failed_precondition and sends no secrets to
	83	+	// jobs. The API never returns a value, and the server never logs one.
	84	+	//
	85	+	// Page sizes and page tokens work as in the other services.
	86	+	//
	87	+	// Servers that implement it list "ci.secrets" in GetVersionResponse.features.
	88	+	service SecretService {
	89	+	// SetSecret creates the secret or replaces its value. Fails with
	90	+	// invalid_argument if the name is not valid, if the value is empty or longer
	91	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	92	+	// environment of the scope does not exist, and with failed_precondition if
	93	+	// the server has no encryption key.
	94	+	rpc SetSecret(SetSecretRequest) returns (SetSecretResponse);
	95	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	96	+	// the secrets set in that scope, not the ones the scope inherits. It never
	97	+	// returns values.
	98	+	rpc ListSecrets(ListSecretsRequest) returns (ListSecretsResponse);
	99	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	100	+	rpc DeleteSecret(DeleteSecretRequest) returns (DeleteSecretResponse);
	101	+	}
	102	+
	103	+	// SetSecretRequest names a secret and gives its value.
	104	+	message SetSecretRequest {
	105	+	// Scope is where the secret lives.
	106	+	SettingsScope scope = 1;
	107	+	// Name is the name of the secret.
	108	+	string name = 2;
	109	+	// Value is the value in plain text, 1 byte to 48 KiB. It may contain
	110	+	// several lines.
	111	+	string value = 3;
	112	+	}
	113	+
	114	+	// SetSecretResponse describes the stored secret.
	115	+	message SetSecretResponse {
	116	+	// Secret is the secret, without its value.
	117	+	Secret secret = 1;
	118	+	}
	119	+
	120	+	// ListSecretsRequest selects a page of the secrets of a scope.
	121	+	message ListSecretsRequest {
	122	+	// Scope is the scope to list.
	123	+	SettingsScope scope = 1;
	124	+	// PageSize is the maximum number of secrets to return. 0 means the server
	125	+	// default; values above the server maximum are lowered to it.
	126	+	int32 page_size = 2;
	127	+	// PageToken is the next_page_token of a previous response. Empty for the
	128	+	// first page.
	129	+	string page_token = 3;
	130	+	}
	131	+
	132	+	// ListSecretsResponse is one page of secrets.
	133	+	message ListSecretsResponse {
	134	+	// Secrets are the secrets of this page, ordered by name, without values.
	135	+	repeated Secret secrets = 1;
	136	+	// NextPageToken is passed as page_token to get the next page. Empty when
	137	+	// there is no next page.
	138	+	string next_page_token = 2;
	139	+	}
	140	+
	141	+	// DeleteSecretRequest names the secret to delete.
	142	+	message DeleteSecretRequest {
	143	+	// Scope is where the secret lives.
	144	+	SettingsScope scope = 1;
	145	+	// Name is the name of the secret, without regard to case.
	146	+	string name = 2;
	147	+	}
	148	+
	149	+	// DeleteSecretResponse is empty.
	150	+	message DeleteSecretResponse {}
	151	+
	152	+	// VariableService manages the configuration variables that CI jobs receive in
	153	+	// the "vars" context, like `gh variable` does on GitHub. Names follow the
	154	+	// rules of SecretService. Access rules, errors and page handling are those of
	155	+	// SecretService, and the same servers (feature "ci.secrets") implement it.
	156	+	service VariableService {
	157	+	// SetVariable creates the variable or replaces its value. Fails with
	158	+	// invalid_argument if the name is not valid, if the value is longer than 48
	159	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	160	+	// environment of the scope does not exist. An empty value is allowed.
	161	+	rpc SetVariable(SetVariableRequest) returns (SetVariableResponse);
	162	+	// GetVariable returns one variable of one scope, with its value. Fails with
	163	+	// not_found if it does not exist in that scope.
	164	+	rpc GetVariable(GetVariableRequest) returns (GetVariableResponse);
	165	+	// ListVariables lists the variables of one scope, ordered by name, with
	166	+	// their values. It lists only the variables set in that scope.
	167	+	rpc ListVariables(ListVariablesRequest) returns (ListVariablesResponse);
	168	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	169	+	// exist.
	170	+	rpc DeleteVariable(DeleteVariableRequest) returns (DeleteVariableResponse);
	171	+	}
	172	+
	173	+	// SetVariableRequest names a variable and gives its value.
	174	+	message SetVariableRequest {
	175	+	// Scope is where the variable lives.
	176	+	SettingsScope scope = 1;
	177	+	// Name is the name of the variable.
	178	+	string name = 2;
	179	+	// Value is the value, at most 48 KiB.
	180	+	string value = 3;
	181	+	}
	182	+
	183	+	// SetVariableResponse holds the stored variable.
	184	+	message SetVariableResponse {
	185	+	// Variable is the variable as stored.
	186	+	Variable variable = 1;
	187	+	}
	188	+
	189	+	// GetVariableRequest names a variable.
	190	+	message GetVariableRequest {
	191	+	// Scope is where the variable lives.
	192	+	SettingsScope scope = 1;
	193	+	// Name is the name of the variable, without regard to case.
	194	+	string name = 2;
	195	+	}
	196	+
	197	+	// GetVariableResponse holds a variable.
	198	+	message GetVariableResponse {
	199	+	// Variable is the variable.
	200	+	Variable variable = 1;
	201	+	}
	202	+
	203	+	// ListVariablesRequest selects a page of the variables of a scope.
	204	+	message ListVariablesRequest {
	205	+	// Scope is the scope to list.
	206	+	SettingsScope scope = 1;
	207	+	// PageSize is the maximum number of variables to return. 0 means the server
	208	+	// default; values above the server maximum are lowered to it.
	209	+	int32 page_size = 2;
	210	+	// PageToken is the next_page_token of a previous response. Empty for the
	211	+	// first page.
	212	+	string page_token = 3;
	213	+	}
	214	+
	215	+	// ListVariablesResponse is one page of variables.
	216	+	message ListVariablesResponse {
	217	+	// Variables are the variables of this page, ordered by name.
	218	+	repeated Variable variables = 1;
	219	+	// NextPageToken is passed as page_token to get the next page. Empty when
	220	+	// there is no next page.
	221	+	string next_page_token = 2;
	222	+	}
	223	+
	224	+	// DeleteVariableRequest names the variable to delete.
	225	+	message DeleteVariableRequest {
	226	+	// Scope is where the variable lives.
	227	+	SettingsScope scope = 1;
	228	+	// Name is the name of the variable, without regard to case.
	229	+	string name = 2;
	230	+	}
	231	+
	232	+	// DeleteVariableResponse is empty.
	233	+	message DeleteVariableResponse {}
	234	+
	235	+	// EnvironmentService manages the environments of a repository, to which
	236	+	// secrets and variables are attached. Environments have no protection rules
	237	+	// and no deployments. Access rules and errors are those of SecretService (the
	238	+	// secrets:write scope, no token limited to branches), and the same servers
	239	+	// (feature "ci.secrets") implement it.
	240	+	service EnvironmentService {
	241	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	242	+	// if the environment already exists (without regard to case), as GitHub's
	243	+	// create-or-update does. Fails with invalid_argument if the name is not
	244	+	// valid and with not_found if the repository does not exist.
	245	+	rpc CreateEnvironment(CreateEnvironmentRequest) returns (CreateEnvironmentResponse);
	246	+	// ListEnvironments lists the environments of a repository, ordered by name.
	247	+	rpc ListEnvironments(ListEnvironmentsRequest) returns (ListEnvironmentsResponse);
	248	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	249	+	// Fails with not_found if it does not exist.
	250	+	rpc DeleteEnvironment(DeleteEnvironmentRequest) returns (DeleteEnvironmentResponse);
	251	+	}
	252	+
	253	+	// CreateEnvironmentRequest names the environment to create.
	254	+	message CreateEnvironmentRequest {
	255	+	// Repo is the repository name.
	256	+	string repo = 1;
	257	+	// Name is the name of the environment, see Environment.name.
	258	+	string name = 2;
	259	+	}
	260	+
	261	+	// CreateEnvironmentResponse holds the environment.
	262	+	message CreateEnvironmentResponse {
	263	+	// Environment is the environment, new or existing.
	264	+	Environment environment = 1;
	265	+	}
	266	+
	267	+	// ListEnvironmentsRequest selects a page of the environments of a repository.
	268	+	message ListEnvironmentsRequest {
	269	+	// Repo is the repository name.
	270	+	string repo = 1;
	271	+	// PageSize is the maximum number of environments to return. 0 means the
	272	+	// server default; values above the server maximum are lowered to it.
	273	+	int32 page_size = 2;
	274	+	// PageToken is the next_page_token of a previous response. Empty for the
	275	+	// first page.
	276	+	string page_token = 3;
	277	+	}
	278	+
	279	+	// ListEnvironmentsResponse is one page of environments.
	280	+	message ListEnvironmentsResponse {
	281	+	// Environments are the environments of this page, ordered by name.
	282	+	repeated Environment environments = 1;
	283	+	// NextPageToken is passed as page_token to get the next page. Empty when
	284	+	// there is no next page.
	285	+	string next_page_token = 2;
	286	+	}
	287	+
	288	+	// DeleteEnvironmentRequest names the environment to delete.
	289	+	message DeleteEnvironmentRequest {
	290	+	// Repo is the repository name.
	291	+	string repo = 1;
	292	+	// Name is the name of the environment, without regard to case.
	293	+	string name = 2;
	294	+	}
	295	+
	296	+	// DeleteEnvironmentResponse is empty.
	297	+	message DeleteEnvironmentResponse {}

M proto/ermite/run.proto +61 -6


@@ -36,9 +36,10 @@ message Run {
36	36		// the name of the workflow registered for workflow_path (the "name" of that
37	37		// file on the default branch, else workflow_name).
38	38		string title = 7;
39		-	// Event is the event that triggered the run, in GitHub's name: "push" (the
40		-	// only one for now; push to a branch or a tag, and merge of a merge
41		-	// request). New values may be added; clients show the ones they do not
	39	+	// Event is the event that triggered the run, in GitHub's name: "push" (push
	40	+	// to a branch or a tag, and merge of a merge request), and from servers with
	41	+	// the matching trigger "pull_request", "workflow_dispatch", "schedule" and
	42	+	// "workflow_run". New values may be added; clients show the ones they do not
42	43		// know as they are.
43	44		string event = 8;
44	45		// Ref is the full ref name that was pushed, for example "refs/heads/main"

@@ -84,6 +85,14 @@ message Run {
84	85		// the workflow has a "run-name". A run stored before this field existed
85	86		// reads as workflow_name.
86	87		string name = 19;
	88	+	// Trusted is true when the run may use secrets and a job token with write
	89	+	// permissions: its actor is the owner, a "workflow_run" inherits it from the
	90	+	// run that triggered it, and a re-run keeps it only if the original run had
	91	+	// it and the caller of the re-run is the owner. It is false when the actor
	92	+	// is a token limited to branches (see Job.trusted). It never goes from false
	93	+	// to true. False for a run stored before this field existed and from servers
	94	+	// without the feature "ci.secrets".
	95	+	bool trusted = 20;
87	96		}
88	97
89	98		// RunJob is a job of a run as people see it: the state of one job instance

@@ -109,7 +118,7 @@ message RunJob {
109	118		// name of the job's check.
110	119		string name = 6;
111	120		// Status is where the job is. A job waits QUEUED for a runner and for the
112		-	// jobs it needs.
	121	+	// jobs it needs, and PENDING for its concurrency group.
113	122		CiStatus status = 7;
114	123		// Conclusion is how the job ended. Unset until status is COMPLETED.
115	124		CiConclusion conclusion = 8;

@@ -148,6 +157,12 @@ message RunJob {
148	157		// and never goes back. A client that holds two copies of a job keeps the
149	158		// one with the higher version and drops the other, as for Run.version.
150	159		int64 version = 19;
	160	+	// ConcurrencyGroup is the evaluated concurrency group of the job (its
	161	+	// "concurrency:", or the one of its workflow), compared without regard to
	162	+	// case within the repository. Empty when the job has none and from servers
	163	+	// without the feature "ci.concurrency". The job is PENDING while another job
	164	+	// of the group runs or a newer one is waiting.
	165	+	string concurrency_group = 20;
151	166		}
152	167
153	168		// Step is one step of a job, with where its lines are in the job log.

@@ -261,12 +276,15 @@ message Runner {
261	276		// request (other fields must be unchanged).
262	277		//
263	278		// Servers that implement the runs side (every RPC but ListRunners,
264		-	// RemoveRunner, ListAnnotations and GetStepSummaries) list "ci.runs" in
	279	+	// RemoveRunner, ListAnnotations, GetStepSummaries and DispatchWorkflow) list
	280	+	// "ci.runs" in
265	281		// GetVersionResponse.features; those that
266	282		// implement the runners side list "ci.runners", as RunnerService does. A server
267	283		// that honours the filters of ListRunsRequest also lists "ci.runs.filters".
268	284		// ListAnnotations needs "ci.annotations" and GetStepSummaries "ci.summaries",
269		-	// which are also the features of the runner side of each.
	285	+	// which are also the features of the runner side of each. DispatchWorkflow
	286	+	// needs "ci.dispatch". RunJob.concurrency_group and CI_STATUS_PENDING belong
	287	+	// to "ci.concurrency", Run.trusted to "ci.secrets".
270	288		service RunService {
271	289		// ListRuns lists the runs of a repository, highest id (newest) first. Each
272	290		// run is described by its latest attempt. The filters narrow the result; a

@@ -332,6 +350,21 @@ service RunService {
332	350		// with failed_precondition if the latest attempt has not completed, or if
333	351		// failed_only is set and no job failed. The new attempt is returned QUEUED.
334	352		rpc RerunRun(RerunRunRequest) returns (RerunRunResponse);
	353	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
	354	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
	355	+	// scope on the repository. The workflow is read at ref and must have
	356	+	// "workflow_dispatch" among its events. The run has event
	357	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
	358	+	// actor; it is trusted when the caller is the owner and not trusted when the
	359	+	// caller is a token limited to branches. The run is returned QUEUED, before
	360	+	// any job has been given to a runner. Only servers with the feature
	361	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
	362	+	// not_found if the repository, the workflow file or ref does not exist,
	363	+	// with failed_precondition if the workflow does not declare
	364	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
	365	+	// missing while required without default, or has a value of the wrong type
	366	+	// or outside its choices, or if the workflow file is not valid.
	367	+	rpc DispatchWorkflow(DispatchWorkflowRequest) returns (DispatchWorkflowResponse);
335	368		// ListChecks lists the checks of a commit: for each job of each run on that
336	369		// sha, the one of the latest attempt, ordered by creation time then name.
337	370		// A commit without a run has no check: the list is empty, which is not an

@@ -556,6 +589,28 @@ message RerunRunResponse {
556	589		Run run = 1;
557	590		}
558	591
	592	+	// DispatchWorkflowRequest names the workflow to run and its inputs.
	593	+	message DispatchWorkflowRequest {
	594	+	// Repo is the repository name.
	595	+	string repo = 1;
	596	+	// WorkflowPath is the path of the workflow file at ref, for example
	597	+	// ".github/workflows/ci.yml", or its file name ("ci.yml").
	598	+	string workflow_path = 2;
	599	+	// Ref is the branch or tag to run on, by short name ("main") or full name
	600	+	// ("refs/heads/main"). Empty means the default branch of the repository.
	601	+	string ref = 3;
	602	+	// Inputs are the values of the "inputs" of the workflow's
	603	+	// "workflow_dispatch" by name, as strings: a boolean is "true" or "false", a
	604	+	// number its decimal text. An input left out takes its default.
	605	+	map<string, string> inputs = 4;
	606	+	}
	607	+
	608	+	// DispatchWorkflowResponse holds the new run.
	609	+	message DispatchWorkflowResponse {
	610	+	// Run is the new run, QUEUED, attempt 1.
	611	+	Run run = 1;
	612	+	}
	613	+
559	614		// ListChecksRequest names the commit.
560	615		message ListChecksRequest {
561	616		// Repo is the repository name.


@@ -36,9 +36,10 @@ message Run {
36		// the name of the workflow registered for workflow_path (the "name" of that	36		// the name of the workflow registered for workflow_path (the "name" of that
37		// file on the default branch, else workflow_name).	37		// file on the default branch, else workflow_name).
38		string title = 7;	38		string title = 7;
39	-	// Event is the event that triggered the run, in GitHub's name: "push" (the	39	+	// Event is the event that triggered the run, in GitHub's name: "push" (push
40	-	// only one for now; push to a branch or a tag, and merge of a merge	40	+	// to a branch or a tag, and merge of a merge request), and from servers with
41	-	// request). New values may be added; clients show the ones they do not	41	+	// the matching trigger "pull_request", "workflow_dispatch", "schedule" and
			42	+	// "workflow_run". New values may be added; clients show the ones they do not
42		// know as they are.	43		// know as they are.
43		string event = 8;	44		string event = 8;
44		// Ref is the full ref name that was pushed, for example "refs/heads/main"	45		// Ref is the full ref name that was pushed, for example "refs/heads/main"

@@ -84,6 +85,14 @@ message Run {
84		// the workflow has a "run-name". A run stored before this field existed	85		// the workflow has a "run-name". A run stored before this field existed
85		// reads as workflow_name.	86		// reads as workflow_name.
86		string name = 19;	87		string name = 19;
			88	+	// Trusted is true when the run may use secrets and a job token with write
			89	+	// permissions: its actor is the owner, a "workflow_run" inherits it from the
			90	+	// run that triggered it, and a re-run keeps it only if the original run had
			91	+	// it and the caller of the re-run is the owner. It is false when the actor
			92	+	// is a token limited to branches (see Job.trusted). It never goes from false
			93	+	// to true. False for a run stored before this field existed and from servers
			94	+	// without the feature "ci.secrets".
			95	+	bool trusted = 20;
87		}	96		}
88			97
89		// RunJob is a job of a run as people see it: the state of one job instance	98		// RunJob is a job of a run as people see it: the state of one job instance

@@ -109,7 +118,7 @@ message RunJob {
109		// name of the job's check.	118		// name of the job's check.
110		string name = 6;	119		string name = 6;
111		// Status is where the job is. A job waits QUEUED for a runner and for the	120		// Status is where the job is. A job waits QUEUED for a runner and for the
112	-	// jobs it needs.	121	+	// jobs it needs, and PENDING for its concurrency group.
113		CiStatus status = 7;	122		CiStatus status = 7;
114		// Conclusion is how the job ended. Unset until status is COMPLETED.	123		// Conclusion is how the job ended. Unset until status is COMPLETED.
115		CiConclusion conclusion = 8;	124		CiConclusion conclusion = 8;

@@ -148,6 +157,12 @@ message RunJob {
148		// and never goes back. A client that holds two copies of a job keeps the	157		// and never goes back. A client that holds two copies of a job keeps the
149		// one with the higher version and drops the other, as for Run.version.	158		// one with the higher version and drops the other, as for Run.version.
150		int64 version = 19;	159		int64 version = 19;
			160	+	// ConcurrencyGroup is the evaluated concurrency group of the job (its
			161	+	// "concurrency:", or the one of its workflow), compared without regard to
			162	+	// case within the repository. Empty when the job has none and from servers
			163	+	// without the feature "ci.concurrency". The job is PENDING while another job
			164	+	// of the group runs or a newer one is waiting.
			165	+	string concurrency_group = 20;
151		}	166		}
152			167
153		// Step is one step of a job, with where its lines are in the job log.	168		// Step is one step of a job, with where its lines are in the job log.

@@ -261,12 +276,15 @@ message Runner {
261		// request (other fields must be unchanged).	276		// request (other fields must be unchanged).
262		//	277		//
263		// Servers that implement the runs side (every RPC but ListRunners,	278		// Servers that implement the runs side (every RPC but ListRunners,
264	-	// RemoveRunner, ListAnnotations and GetStepSummaries) list "ci.runs" in	279	+	// RemoveRunner, ListAnnotations, GetStepSummaries and DispatchWorkflow) list
			280	+	// "ci.runs" in
265		// GetVersionResponse.features; those that	281		// GetVersionResponse.features; those that
266		// implement the runners side list "ci.runners", as RunnerService does. A server	282		// implement the runners side list "ci.runners", as RunnerService does. A server
267		// that honours the filters of ListRunsRequest also lists "ci.runs.filters".	283		// that honours the filters of ListRunsRequest also lists "ci.runs.filters".
268		// ListAnnotations needs "ci.annotations" and GetStepSummaries "ci.summaries",	284		// ListAnnotations needs "ci.annotations" and GetStepSummaries "ci.summaries",
269	-	// which are also the features of the runner side of each.	285	+	// which are also the features of the runner side of each. DispatchWorkflow
			286	+	// needs "ci.dispatch". RunJob.concurrency_group and CI_STATUS_PENDING belong
			287	+	// to "ci.concurrency", Run.trusted to "ci.secrets".
270		service RunService {	288		service RunService {
271		// ListRuns lists the runs of a repository, highest id (newest) first. Each	289		// ListRuns lists the runs of a repository, highest id (newest) first. Each
272		// run is described by its latest attempt. The filters narrow the result; a	290		// run is described by its latest attempt. The filters narrow the result; a

@@ -332,6 +350,21 @@ service RunService {
332		// with failed_precondition if the latest attempt has not completed, or if	350		// with failed_precondition if the latest attempt has not completed, or if
333		// failed_only is set and no job failed. The new attempt is returned QUEUED.	351		// failed_only is set and no job failed. The new attempt is returned QUEUED.
334		rpc RerunRun(RerunRunRequest) returns (RerunRunResponse);	352		rpc RerunRun(RerunRunRequest) returns (RerunRunResponse);
			353	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
			354	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
			355	+	// scope on the repository. The workflow is read at ref and must have
			356	+	// "workflow_dispatch" among its events. The run has event
			357	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
			358	+	// actor; it is trusted when the caller is the owner and not trusted when the
			359	+	// caller is a token limited to branches. The run is returned QUEUED, before
			360	+	// any job has been given to a runner. Only servers with the feature
			361	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
			362	+	// not_found if the repository, the workflow file or ref does not exist,
			363	+	// with failed_precondition if the workflow does not declare
			364	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
			365	+	// missing while required without default, or has a value of the wrong type
			366	+	// or outside its choices, or if the workflow file is not valid.
			367	+	rpc DispatchWorkflow(DispatchWorkflowRequest) returns (DispatchWorkflowResponse);
335		// ListChecks lists the checks of a commit: for each job of each run on that	368		// ListChecks lists the checks of a commit: for each job of each run on that
336		// sha, the one of the latest attempt, ordered by creation time then name.	369		// sha, the one of the latest attempt, ordered by creation time then name.
337		// A commit without a run has no check: the list is empty, which is not an	370		// A commit without a run has no check: the list is empty, which is not an

@@ -556,6 +589,28 @@ message RerunRunResponse {
556		Run run = 1;	589		Run run = 1;
557		}	590		}
558			591
			592	+	// DispatchWorkflowRequest names the workflow to run and its inputs.
			593	+	message DispatchWorkflowRequest {
			594	+	// Repo is the repository name.
			595	+	string repo = 1;
			596	+	// WorkflowPath is the path of the workflow file at ref, for example
			597	+	// ".github/workflows/ci.yml", or its file name ("ci.yml").
			598	+	string workflow_path = 2;
			599	+	// Ref is the branch or tag to run on, by short name ("main") or full name
			600	+	// ("refs/heads/main"). Empty means the default branch of the repository.
			601	+	string ref = 3;
			602	+	// Inputs are the values of the "inputs" of the workflow's
			603	+	// "workflow_dispatch" by name, as strings: a boolean is "true" or "false", a
			604	+	// number its decimal text. An input left out takes its default.
			605	+	map<string, string> inputs = 4;
			606	+	}
			607	+
			608	+	// DispatchWorkflowResponse holds the new run.
			609	+	message DispatchWorkflowResponse {
			610	+	// Run is the new run, QUEUED, attempt 1.
			611	+	Run run = 1;
			612	+	}
			613	+
559		// ListChecksRequest names the commit.	614		// ListChecksRequest names the commit.
560		message ListChecksRequest {	615		message ListChecksRequest {
561		// Repo is the repository name.	616		// Repo is the repository name.

M proto/ermite/runner.proto +84 -4


@@ -19,6 +19,11 @@ enum CiStatus {
19	19		CI_STATUS_IN_PROGRESS = 2;
20	20		// Over. The conclusion says how it ended.
21	21		CI_STATUS_COMPLETED = 3;
	22	+	// Held back by a concurrency group: another run or job of the group is
	23	+	// running, or a newer one is waiting (see RunJob.concurrency_group). Only for
	24	+	// jobs and checks, and only from servers with the feature "ci.concurrency";
	25	+	// a client that does not know the value shows it as queued.
	26	+	CI_STATUS_PENDING = 4;
22	27		}
23	28
24	29		// CiConclusion is how a run, a job, a step or a check ended, with GitHub's

@@ -171,7 +176,9 @@ enum ActionSource {
171	176		// Job.github_token also list "ci.actions", those that accept annotations
172	177		// (UpdateJobRequest.annotations, CompleteJobRequest.annotations) list
173	178		// "ci.annotations", and those that implement UploadSummary list
174		-	// "ci.summaries". A server without a feature ignores the fields of that
	179	+	// "ci.summaries". Those that send Job.secrets, Job.vars, Job.environment,
	180	+	// Job.permissions and Job.trusted list "ci.secrets", and those that send
	181	+	// Job.cache list "ci.cache". A server without a feature ignores the fields of that
175	182		// feature (protobuf drops unknown fields) and answers unimplemented to its
176	183		// RPCs; a runner that needs one checks GetVersion first.
177	184		service RunnerService {

@@ -534,14 +541,84 @@ message Job {
534	541		// "secrets.GITHUB_TOKEN" of the job: "ermitegh_" and 43 base64url characters
535	542		// (32 random bytes, no padding). Unlike job_token it is meant for the code of
536	543		// the job: the runner gives it to the sandbox (actions/checkout clones with
537		-	// it). It can only read the repository of the run (read-only, whatever
538		-	// "permissions:" says), and is valid from the assignment until the job ends
	544	+	// it). It can only act on the repository of the run: read-only from servers
	545	+	// without the feature "ci.secrets", whatever "permissions:" says, and with
	546	+	// the rights of permissions from those that have it (never more than read
	547	+	// when trusted is false). It is valid from the assignment until the job ends
539	548		// (it is revoked then, on cancellation and when the job is lost). It is a
540	549		// secret: the runner registers it in its masker before anything runs, and
541	550		// neither the runner nor the server logs it. It is shown only in this
542	551		// response, or in a repeat of the same poll_id; a new assignment of the same
543	552		// job has a new one. Empty from servers without the feature "ci.actions".
544	553		string github_token = 15;
	554	+	// Secrets are the secrets of the job by name (upper case), in plain text:
	555	+	// the ones the job's workflow refers to, from the instance, the repository
	556	+	// and the environment, with the environment overriding the repository and
	557	+	// the repository the instance. The server picks them; the runner uses them
	558	+	// as they are. They are empty when the job is not trusted, when the job
	559	+	// refers to none, and from servers without the feature "ci.secrets"; the
	560	+	// "GITHUB_TOKEN" secret is github_token, not an entry here. They travel only
	561	+	// over the runner's authenticated channel. The runner never logs them, never
	562	+	// writes them to disk or to its recovery state, and registers them in its
	563	+	// log masker before the first step runs, as GitHub's runner does: each value
	564	+	// trimmed, each non-empty trimmed line of it (split on CR and LF), and the
	565	+	// encoded forms of each. The server never stores them in the run record nor
	566	+	// logs them. Treat the whole map as a secret.
	567	+	map<string, string> secrets = 16;
	568	+	// Vars are the configuration variables of the job by name (upper case),
	569	+	// already merged by the server with environment over repository over
	570	+	// instance. They are not secret. The same values are in the "vars" context
	571	+	// of contexts, which the runner may use instead. Empty from servers without
	572	+	// the feature "ci.secrets".
	573	+	map<string, string> vars = 17;
	574	+	// Environment is the name of the environment the job deploys to (the
	575	+	// evaluated "environment:" of the job). Empty when the job has none. It is
	576	+	// environment that secrets and vars were resolved for.
	577	+	string environment = 18;
	578	+	// Permissions are the effective permissions of github_token. Unset from
	579	+	// servers without the feature "ci.secrets"; the token is then read-only.
	580	+	JobPermissions permissions = 19;
	581	+	// Cache tells the runner which cache entries the job may read and write.
	582	+	// Unset when the server gives the job no cache (the runner then serves no
	583	+	// cache) and from servers without the feature "ci.cache".
	584	+	JobCache cache = 20;
	585	+	// Trusted is true when the run's actor is the owner (or a re-run of a
	586	+	// trusted run by the owner): only then are secrets sent and a write
	587	+	// permission granted. It is false when the actor is a token limited to
	588	+	// branches (an automated agent could otherwise print any secret by pushing a
	589	+	// workflow) and for a re-run of such a run, and then secrets is empty and
	590	+	// github_token is read-only whatever "permissions:" says. The runner states
	591	+	// this in the log of "Set up job". False from servers that do not send it:
	592	+	// the safe reading.
	593	+	bool trusted = 21;
	594	+	}
	595	+
	596	+	// JobPermissions are the permissions of the job repository token, with the
	597	+	// keys and values of the "permissions:" of a GitHub workflow.
	598	+	message JobPermissions {
	599	+	// Levels maps a permission key ("contents", "pull-requests", "id-token",
	600	+	// "actions", ...) to "read", "write" or "none". They are the permissions in
	601	+	// effect after the server merged the workflow's and the job's "permissions:"
	602	+	// (and the caller's, for a reusable workflow) and applied the trust rule of
	603	+	// Job.trusted; a key absent from the map is "none". Keys are lowercase as in
	604	+	// the workflow. The runner prints them in "Set up job" and does not
	605	+	// enforce them: the server checks the token.
	606	+	map<string, string> levels = 1;
	607	+	}
	608	+
	609	+	// JobCache is the scope of the cache of one job. The cache is served by the
	610	+	// runner and shared by the jobs of a repository, as GitHub scopes it.
	611	+	message JobCache {
	612	+	// Repository is the name of the repository whose cache the job uses. Entries
	613	+	// of another repository are never visible to it.
	614	+	string repository = 1;
	615	+	// WriteRef is the only ref the job may save entries under, for example
	616	+	// "refs/heads/main" or "refs/pull/7/merge".
	617	+	string write_ref = 2;
	618	+	// ReadRefs are the refs the job may restore entries from, most specific
	619	+	// first: the ref of the run, then the base branch for a pull request, then
	620	+	// the default branch. Entries under other refs are never restored.
	621	+	repeated string read_refs = 3;
545	622		}
546	623
547	624		// UpdateJobRequest reports the steps of a running job.

@@ -612,7 +689,10 @@ message CompleteJobRequest {
612	689		// are invalid_argument. Each value is at most 1 MiB, and all names and
613	690		// values together at most 1 MiB (1,048,576 bytes); beyond that the whole call
614	691		// is rejected with invalid_argument and the runner reports the failure of
615		-	// the job without outputs, with a line in the log.
	692	+	// the job without outputs, with a line in the log. The runner leaves out an
	693	+	// output whose value its masker would change, with the warning "Skip output
	694	+	// '<name>' since it may contain secret." (as GitHub's runner), so no secret
	695	+	// reaches the server through outputs.
616	696		map<string, string> outputs = 3;
617	697		// RunnerShutdown is true when the runner ends the job because it was told to
618	698		// stop (service stopped, signal). Only allowed with CI_CONCLUSION_CANCELLED.


@@ -19,6 +19,11 @@ enum CiStatus {
19		CI_STATUS_IN_PROGRESS = 2;	19		CI_STATUS_IN_PROGRESS = 2;
20		// Over. The conclusion says how it ended.	20		// Over. The conclusion says how it ended.
21		CI_STATUS_COMPLETED = 3;	21		CI_STATUS_COMPLETED = 3;
			22	+	// Held back by a concurrency group: another run or job of the group is
			23	+	// running, or a newer one is waiting (see RunJob.concurrency_group). Only for
			24	+	// jobs and checks, and only from servers with the feature "ci.concurrency";
			25	+	// a client that does not know the value shows it as queued.
			26	+	CI_STATUS_PENDING = 4;
22		}	27		}
23			28
24		// CiConclusion is how a run, a job, a step or a check ended, with GitHub's	29		// CiConclusion is how a run, a job, a step or a check ended, with GitHub's

@@ -171,7 +176,9 @@ enum ActionSource {
171		// Job.github_token also list "ci.actions", those that accept annotations	176		// Job.github_token also list "ci.actions", those that accept annotations
172		// (UpdateJobRequest.annotations, CompleteJobRequest.annotations) list	177		// (UpdateJobRequest.annotations, CompleteJobRequest.annotations) list
173		// "ci.annotations", and those that implement UploadSummary list	178		// "ci.annotations", and those that implement UploadSummary list
174	-	// "ci.summaries". A server without a feature ignores the fields of that	179	+	// "ci.summaries". Those that send Job.secrets, Job.vars, Job.environment,
			180	+	// Job.permissions and Job.trusted list "ci.secrets", and those that send
			181	+	// Job.cache list "ci.cache". A server without a feature ignores the fields of that
175		// feature (protobuf drops unknown fields) and answers unimplemented to its	182		// feature (protobuf drops unknown fields) and answers unimplemented to its
176		// RPCs; a runner that needs one checks GetVersion first.	183		// RPCs; a runner that needs one checks GetVersion first.
177		service RunnerService {	184		service RunnerService {

@@ -534,14 +541,84 @@ message Job {
534		// "secrets.GITHUB_TOKEN" of the job: "ermitegh_" and 43 base64url characters	541		// "secrets.GITHUB_TOKEN" of the job: "ermitegh_" and 43 base64url characters
535		// (32 random bytes, no padding). Unlike job_token it is meant for the code of	542		// (32 random bytes, no padding). Unlike job_token it is meant for the code of
536		// the job: the runner gives it to the sandbox (actions/checkout clones with	543		// the job: the runner gives it to the sandbox (actions/checkout clones with
537	-	// it). It can only read the repository of the run (read-only, whatever	544	+	// it). It can only act on the repository of the run: read-only from servers
538	-	// "permissions:" says), and is valid from the assignment until the job ends	545	+	// without the feature "ci.secrets", whatever "permissions:" says, and with
			546	+	// the rights of permissions from those that have it (never more than read
			547	+	// when trusted is false). It is valid from the assignment until the job ends
539		// (it is revoked then, on cancellation and when the job is lost). It is a	548		// (it is revoked then, on cancellation and when the job is lost). It is a
540		// secret: the runner registers it in its masker before anything runs, and	549		// secret: the runner registers it in its masker before anything runs, and
541		// neither the runner nor the server logs it. It is shown only in this	550		// neither the runner nor the server logs it. It is shown only in this
542		// response, or in a repeat of the same poll_id; a new assignment of the same	551		// response, or in a repeat of the same poll_id; a new assignment of the same
543		// job has a new one. Empty from servers without the feature "ci.actions".	552		// job has a new one. Empty from servers without the feature "ci.actions".
544		string github_token = 15;	553		string github_token = 15;
			554	+	// Secrets are the secrets of the job by name (upper case), in plain text:
			555	+	// the ones the job's workflow refers to, from the instance, the repository
			556	+	// and the environment, with the environment overriding the repository and
			557	+	// the repository the instance. The server picks them; the runner uses them
			558	+	// as they are. They are empty when the job is not trusted, when the job
			559	+	// refers to none, and from servers without the feature "ci.secrets"; the
			560	+	// "GITHUB_TOKEN" secret is github_token, not an entry here. They travel only
			561	+	// over the runner's authenticated channel. The runner never logs them, never
			562	+	// writes them to disk or to its recovery state, and registers them in its
			563	+	// log masker before the first step runs, as GitHub's runner does: each value
			564	+	// trimmed, each non-empty trimmed line of it (split on CR and LF), and the
			565	+	// encoded forms of each. The server never stores them in the run record nor
			566	+	// logs them. Treat the whole map as a secret.
			567	+	map<string, string> secrets = 16;
			568	+	// Vars are the configuration variables of the job by name (upper case),
			569	+	// already merged by the server with environment over repository over
			570	+	// instance. They are not secret. The same values are in the "vars" context
			571	+	// of contexts, which the runner may use instead. Empty from servers without
			572	+	// the feature "ci.secrets".
			573	+	map<string, string> vars = 17;
			574	+	// Environment is the name of the environment the job deploys to (the
			575	+	// evaluated "environment:" of the job). Empty when the job has none. It is
			576	+	// environment that secrets and vars were resolved for.
			577	+	string environment = 18;
			578	+	// Permissions are the effective permissions of github_token. Unset from
			579	+	// servers without the feature "ci.secrets"; the token is then read-only.
			580	+	JobPermissions permissions = 19;
			581	+	// Cache tells the runner which cache entries the job may read and write.
			582	+	// Unset when the server gives the job no cache (the runner then serves no
			583	+	// cache) and from servers without the feature "ci.cache".
			584	+	JobCache cache = 20;
			585	+	// Trusted is true when the run's actor is the owner (or a re-run of a
			586	+	// trusted run by the owner): only then are secrets sent and a write
			587	+	// permission granted. It is false when the actor is a token limited to
			588	+	// branches (an automated agent could otherwise print any secret by pushing a
			589	+	// workflow) and for a re-run of such a run, and then secrets is empty and
			590	+	// github_token is read-only whatever "permissions:" says. The runner states
			591	+	// this in the log of "Set up job". False from servers that do not send it:
			592	+	// the safe reading.
			593	+	bool trusted = 21;
			594	+	}
			595	+
			596	+	// JobPermissions are the permissions of the job repository token, with the
			597	+	// keys and values of the "permissions:" of a GitHub workflow.
			598	+	message JobPermissions {
			599	+	// Levels maps a permission key ("contents", "pull-requests", "id-token",
			600	+	// "actions", ...) to "read", "write" or "none". They are the permissions in
			601	+	// effect after the server merged the workflow's and the job's "permissions:"
			602	+	// (and the caller's, for a reusable workflow) and applied the trust rule of
			603	+	// Job.trusted; a key absent from the map is "none". Keys are lowercase as in
			604	+	// the workflow. The runner prints them in "Set up job" and does not
			605	+	// enforce them: the server checks the token.
			606	+	map<string, string> levels = 1;
			607	+	}
			608	+
			609	+	// JobCache is the scope of the cache of one job. The cache is served by the
			610	+	// runner and shared by the jobs of a repository, as GitHub scopes it.
			611	+	message JobCache {
			612	+	// Repository is the name of the repository whose cache the job uses. Entries
			613	+	// of another repository are never visible to it.
			614	+	string repository = 1;
			615	+	// WriteRef is the only ref the job may save entries under, for example
			616	+	// "refs/heads/main" or "refs/pull/7/merge".
			617	+	string write_ref = 2;
			618	+	// ReadRefs are the refs the job may restore entries from, most specific
			619	+	// first: the ref of the run, then the base branch for a pull request, then
			620	+	// the default branch. Entries under other refs are never restored.
			621	+	repeated string read_refs = 3;
545		}	622		}
546			623
547		// UpdateJobRequest reports the steps of a running job.	624		// UpdateJobRequest reports the steps of a running job.

@@ -612,7 +689,10 @@ message CompleteJobRequest {
612		// are invalid_argument. Each value is at most 1 MiB, and all names and	689		// are invalid_argument. Each value is at most 1 MiB, and all names and
613		// values together at most 1 MiB (1,048,576 bytes); beyond that the whole call	690		// values together at most 1 MiB (1,048,576 bytes); beyond that the whole call
614		// is rejected with invalid_argument and the runner reports the failure of	691		// is rejected with invalid_argument and the runner reports the failure of
615	-	// the job without outputs, with a line in the log.	692	+	// the job without outputs, with a line in the log. The runner leaves out an
			693	+	// output whose value its masker would change, with the warning "Skip output
			694	+	// '<name>' since it may contain secret." (as GitHub's runner), so no secret
			695	+	// reaches the server through outputs.
616		map<string, string> outputs = 3;	696		map<string, string> outputs = 3;
617		// RunnerShutdown is true when the runner ends the job because it was told to	697		// RunnerShutdown is true when the runner ends the job because it was told to
618		// stop (service stopped, signal). Only allowed with CI_CONCLUSION_CANCELLED.	698		// stop (service stopped, signal). Only allowed with CI_CONCLUSION_CANCELLED.

M proto/ermite/server.proto +5 -1


@@ -39,7 +39,11 @@ message GetVersionResponse {
39	39		// (RunnerService.ResolveActions and Job.github_token), "ci.annotations"
40	40		// (annotations in UpdateJob and CompleteJob, and RunService.ListAnnotations)
41	41		// and "ci.summaries" (RunnerService.UploadSummary and
42		-	// RunService.GetStepSummaries).
	42	+	// RunService.GetStepSummaries). The CI platform identifiers are "ci.secrets"
	43	+	// (SecretService, VariableService and EnvironmentService, and in Job the
	44	+	// secrets, vars, environment, permissions and trusted fields and Run.trusted),
	45	+	// "ci.dispatch" (RunService.DispatchWorkflow), "ci.concurrency"
	46	+	// (CI_STATUS_PENDING and RunJob.concurrency_group) and "ci.cache" (Job.cache).
43	47		repeated string features = 2;
44	48		}
45	49

   // (RunnerService.ResolveActions and Job.github_token), "ci.annotations"
   // (annotations in UpdateJob and CompleteJob, and RunService.ListAnnotations)
   // and "ci.summaries" (RunnerService.UploadSummary and
-  // RunService.GetStepSummaries).
+  // RunService.GetStepSummaries). The CI platform identifiers are "ci.secrets"
+  // (SecretService, VariableService and EnvironmentService, and in Job the
+  // secrets, vars, environment, permissions and trusted fields and Run.trusted),
+  // "ci.dispatch" (RunService.DispatchWorkflow), "ci.concurrency"
+  // (CI_STATUS_PENDING and RunJob.concurrency_group) and "ci.cache" (Job.cache).
   repeated string features = 2;
 }

M proto/ermite/token.proto +4 -2


@@ -28,8 +28,10 @@ enum Scope {
28	28		// SCOPE_CI_WRITE allows re-running or cancelling CI runs. Wire name:
29	29		// ci:write.
30	30		SCOPE_CI_WRITE = 6;
31		-	// SCOPE_SECRETS_WRITE allows setting and deleting secrets and variables.
32		-	// Wire name: secrets:write.
	31	+	// SCOPE_SECRETS_WRITE allows managing secrets, variables and environments
	32	+	// (SecretService, VariableService, EnvironmentService), reads included. A
	33	+	// token limited to branches is refused them even with this scope. Wire name:
	34	+	// secrets:write.
33	35		SCOPE_SECRETS_WRITE = 7;
34	36		// SCOPE_RUNNER_REGISTER allows registering a CI runner. Wire name:
35	37		// runner:register.

   // SCOPE_CI_WRITE allows re-running or cancelling CI runs. Wire name:
   // ci:write.
   SCOPE_CI_WRITE = 6;
-  // SCOPE_SECRETS_WRITE allows setting and deleting secrets and variables.
+  // SCOPE_SECRETS_WRITE allows managing secrets, variables and environments
-  // Wire name: secrets:write.
+  // (SecretService, VariableService, EnvironmentService), reads included. A
+  // token limited to branches is refused them even with this scope. Wire name:
+  // secrets:write.
   SCOPE_SECRETS_WRITE = 7;
   // SCOPE_RUNNER_REGISTER allows registering a CI runner. Wire name:
   // runner:register.