feat(proto): CI-3 secrets, variables, environments, dispatch, permissions, cache (#10)

commit: 5c335b8558242842327d24d060f3a58a1e636ef4
author: brice · 8d ago · 2026-10-14 20:02 UTC
committer: bnema · 8d ago · 2026-10-14 20:02 UTC
parent: 49ac5fd
signature: SSH UnverifiedSHA256:VOCA5lYARHcbKDZ7GhTV45VmcjWnJ6ZQIBazj17LivA The key is unknown
refs: tag: v0.3.0

14 files · +3459 -269

M README.md +6 -3


@@ -2,7 +2,7 @@
2	2
3	3		The public API contract of [ermite](https://git.bnema.dev/bnema/ermite), a single-user Git forge: protobuf definitions for its ConnectRPC services and the Go code generated from them.
4	4
5		-	Status: early development. The contract defines nine services (below); the server that implements them is being built.
	5	+	Status: early development. The contract defines twelve services (below); the server that implements them is being built.
6	6
7	7		```go
8	8		import "bnema.dev/ermite-api/gen/ermite"

@@ -23,14 +23,17 @@ Handlers are mounted under `/-/api/` by the server. Errors are Connect codes.
23	23		\| `SessionService` \| `CreateLoginLink`, `SignOutEverywhere` (owner only) \|
24	24		\| `EventService` \| `Watch` (streamed, resumable) \|
25	25		\| `RunnerService` \| `RegisterRunner`, `FetchJob` (long poll), `UpdateJob` (steps, annotations), `AppendLog` (offset-idempotent), `Heartbeat`, `WatchJob` (cancel requests, streamed), `CompleteJob` (idempotent), `ResolveActions` (where to download the `uses:` actions), `UploadSummary` (job summary of a step); for CI runners \|
26		-	\| `RunService` \| `ListRuns`, `GetRun`, `GetJob`, `GetJobLog` (streamed, follow), `ListAnnotations`, `GetStepSummaries`, `CancelRun`, `RerunRun`, `ListChecks`, `ListRunners`, `RemoveRunner` \|
	26	+	\| `RunService` \| `ListRuns`, `GetRun`, `GetJob`, `GetJobLog` (streamed, follow), `ListAnnotations`, `GetStepSummaries`, `CancelRun`, `RerunRun`, `DispatchWorkflow`, `ListChecks`, `ListRunners`, `RemoveRunner` \|
	27	+	\| `SecretService` \| `SetSecret`, `ListSecrets` (names only, never values), `DeleteSecret`; scopes instance, repository and environment \|
	28	+	\| `VariableService` \| `SetVariable`, `GetVariable`, `ListVariables`, `DeleteVariable`; same scopes \|
	29	+	\| `EnvironmentService` \| `CreateEnvironment`, `ListEnvironments`, `DeleteEnvironment` \|
27	30		\| `ServerService` \| `GetVersion` (server version and feature list), `GetSigningKey` (commit signing key) \|
28	31
29	32		Tokens carry scopes only; presets such as `cli` or `agent` are a client concern.
30	33
31	34		## Layout
32	35
33		-	- `proto/ermite/`: `.proto` files of the `ermite` package, one per service (`repo`, `git`, `merge_request`, `token`, `session`, `event`, `server`, `runner`, `run`) plus shared `types`. Checked by `buf lint` and `buf breaking`.
	36	+	- `proto/ermite/`: `.proto` files of the `ermite` package, one per service (`repo`, `git`, `merge_request`, `token`, `session`, `event`, `server`, `runner`, `run`, `ci_settings`) plus shared `types`. Checked by `buf lint` and `buf breaking`.
34	37		- `gen/ermite/`: generated Go messages. `gen/ermite/ermiteconnect/`: generated Connect clients and handlers. Committed, never edited by hand.
35	38
36	39		## Generate

 The public API contract of [ermite](https://git.bnema.dev/bnema/ermite), a single-user Git forge: protobuf definitions for its ConnectRPC services and the Go code generated from them.
-Status: early development. The contract defines nine services (below); the server that implements them is being built.
+Status: early development. The contract defines twelve services (below); the server that implements them is being built.
 ```go
 import "bnema.dev/ermite-api/gen/ermite"
 | `SessionService` | `CreateLoginLink`, `SignOutEverywhere` (owner only) |
 | `EventService` | `Watch` (streamed, resumable) |
 | `RunnerService` | `RegisterRunner`, `FetchJob` (long poll), `UpdateJob` (steps, annotations), `AppendLog` (offset-idempotent), `Heartbeat`, `WatchJob` (cancel requests, streamed), `CompleteJob` (idempotent), `ResolveActions` (where to download the `uses:` actions), `UploadSummary` (job summary of a step); for CI runners |
-| `RunService` | `ListRuns`, `GetRun`, `GetJob`, `GetJobLog` (streamed, follow), `ListAnnotations`, `GetStepSummaries`, `CancelRun`, `RerunRun`, `ListChecks`, `ListRunners`, `RemoveRunner` |
+| `RunService` | `ListRuns`, `GetRun`, `GetJob`, `GetJobLog` (streamed, follow), `ListAnnotations`, `GetStepSummaries`, `CancelRun`, `RerunRun`, `DispatchWorkflow`, `ListChecks`, `ListRunners`, `RemoveRunner` |
+| `SecretService` | `SetSecret`, `ListSecrets` (names only, never values), `DeleteSecret`; scopes instance, repository and environment |
+| `VariableService` | `SetVariable`, `GetVariable`, `ListVariables`, `DeleteVariable`; same scopes |
+| `EnvironmentService` | `CreateEnvironment`, `ListEnvironments`, `DeleteEnvironment` |
 | `ServerService` | `GetVersion` (server version and feature list), `GetSigningKey` (commit signing key) |
 Tokens carry scopes only; presets such as `cli` or `agent` are a client concern.
 ## Layout
-- `proto/ermite/`: `.proto` files of the `ermite` package, one per service (`repo`, `git`, `merge_request`, `token`, `session`, `event`, `server`, `runner`, `run`) plus shared `types`. Checked by `buf lint` and `buf breaking`.
+- `proto/ermite/`: `.proto` files of the `ermite` package, one per service (`repo`, `git`, `merge_request`, `token`, `session`, `event`, `server`, `runner`, `run`, `ci_settings`) plus shared `types`. Checked by `buf lint` and `buf breaking`.
 - `gen/ermite/`: generated Go messages. `gen/ermite/ermiteconnect/`: generated Connect clients and handlers. Committed, never edited by hand.
 ## Generate

A gen/ermite/ci_settings.pb.go +1660 -0 generated file: collapsed

load diff

A gen/ermite/ermiteconnect/ci_settings.connect.go +515 -0

@@ -0,0 +1,515 @@
	1	+	// SPDX-License-Identifier: MIT
	2	+
	3	+	// Code generated by protoc-gen-connect-go. DO NOT EDIT.
	4	+	//
	5	+	// Source: ermite/ci_settings.proto
	6	+
	7	+	package ermiteconnect
	8	+
	9	+	import (
	10	+	ermite "bnema.dev/ermite-api/gen/ermite"
	11	+	connect "connectrpc.com/connect"
	12	+	context "context"
	13	+	errors "errors"
	14	+	http "net/http"
	15	+	strings "strings"
	16	+	)
	17	+
	18	+	// This is a compile-time assertion to ensure that this generated file and the connect package are
	19	+	// compatible. If you get a compiler error that this constant is not defined, this code was
	20	+	// generated with a version of connect newer than the one compiled into your binary. You can fix the
	21	+	// problem by either regenerating this code with an older version of connect or updating the connect
	22	+	// version compiled into your binary.
	23	+	const _ = connect.IsAtLeastVersion1_13_0
	24	+
	25	+	const (
	26	+	// SecretServiceName is the fully-qualified name of the SecretService service.
	27	+	SecretServiceName = "ermite.SecretService"
	28	+	// VariableServiceName is the fully-qualified name of the VariableService service.
	29	+	VariableServiceName = "ermite.VariableService"
	30	+	// EnvironmentServiceName is the fully-qualified name of the EnvironmentService service.
	31	+	EnvironmentServiceName = "ermite.EnvironmentService"
	32	+	)
	33	+
	34	+	// These constants are the fully-qualified names of the RPCs defined in this package. They're
	35	+	// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
	36	+	//
	37	+	// Note that these are different from the fully-qualified method names used by
	38	+	// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
	39	+	// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
	40	+	// period.
	41	+	const (
	42	+	// SecretServiceSetSecretProcedure is the fully-qualified name of the SecretService's SetSecret RPC.
	43	+	SecretServiceSetSecretProcedure = "/ermite.SecretService/SetSecret"
	44	+	// SecretServiceListSecretsProcedure is the fully-qualified name of the SecretService's ListSecrets
	45	+	// RPC.
	46	+	SecretServiceListSecretsProcedure = "/ermite.SecretService/ListSecrets"
	47	+	// SecretServiceDeleteSecretProcedure is the fully-qualified name of the SecretService's
	48	+	// DeleteSecret RPC.
	49	+	SecretServiceDeleteSecretProcedure = "/ermite.SecretService/DeleteSecret"
	50	+	// VariableServiceSetVariableProcedure is the fully-qualified name of the VariableService's
	51	+	// SetVariable RPC.
	52	+	VariableServiceSetVariableProcedure = "/ermite.VariableService/SetVariable"
	53	+	// VariableServiceGetVariableProcedure is the fully-qualified name of the VariableService's
	54	+	// GetVariable RPC.
	55	+	VariableServiceGetVariableProcedure = "/ermite.VariableService/GetVariable"
	56	+	// VariableServiceListVariablesProcedure is the fully-qualified name of the VariableService's
	57	+	// ListVariables RPC.
	58	+	VariableServiceListVariablesProcedure = "/ermite.VariableService/ListVariables"
	59	+	// VariableServiceDeleteVariableProcedure is the fully-qualified name of the VariableService's
	60	+	// DeleteVariable RPC.
	61	+	VariableServiceDeleteVariableProcedure = "/ermite.VariableService/DeleteVariable"
	62	+	// EnvironmentServiceCreateEnvironmentProcedure is the fully-qualified name of the
	63	+	// EnvironmentService's CreateEnvironment RPC.
	64	+	EnvironmentServiceCreateEnvironmentProcedure = "/ermite.EnvironmentService/CreateEnvironment"
	65	+	// EnvironmentServiceListEnvironmentsProcedure is the fully-qualified name of the
	66	+	// EnvironmentService's ListEnvironments RPC.
	67	+	EnvironmentServiceListEnvironmentsProcedure = "/ermite.EnvironmentService/ListEnvironments"
	68	+	// EnvironmentServiceDeleteEnvironmentProcedure is the fully-qualified name of the
	69	+	// EnvironmentService's DeleteEnvironment RPC.
	70	+	EnvironmentServiceDeleteEnvironmentProcedure = "/ermite.EnvironmentService/DeleteEnvironment"
	71	+	)
	72	+
	73	+	// SecretServiceClient is a client for the ermite.SecretService service.
	74	+	type SecretServiceClient interface {
	75	+	// SetSecret creates the secret or replaces its value. Fails with
	76	+	// invalid_argument if the name is not valid, if the value is empty or longer
	77	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	78	+	// environment of the scope does not exist, and with failed_precondition if
	79	+	// the server has no encryption key.
	80	+	SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error)
	81	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	82	+	// the secrets set in that scope, not the ones the scope inherits. It never
	83	+	// returns values.
	84	+	ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error)
	85	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	86	+	DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error)
	87	+	}
	88	+
	89	+	// NewSecretServiceClient constructs a client for the ermite.SecretService service. By default, it
	90	+	// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
	91	+	// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
	92	+	// connect.WithGRPCWeb() options.
	93	+	//
	94	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	95	+	// http://api.acme.com or https://acme.com/grpc).
	96	+	func NewSecretServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) SecretServiceClient {
	97	+	baseURL = strings.TrimRight(baseURL, "/")
	98	+	secretServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("SecretService").Methods()
	99	+	return &secretServiceClient{
	100	+	setSecret: connect.NewClient[ermite.SetSecretRequest, ermite.SetSecretResponse](
	101	+	httpClient,
	102	+	baseURL+SecretServiceSetSecretProcedure,
	103	+	connect.WithSchema(secretServiceMethods.ByName("SetSecret")),
	104	+	connect.WithClientOptions(opts...),
	105	+	),
	106	+	listSecrets: connect.NewClient[ermite.ListSecretsRequest, ermite.ListSecretsResponse](
	107	+	httpClient,
	108	+	baseURL+SecretServiceListSecretsProcedure,
	109	+	connect.WithSchema(secretServiceMethods.ByName("ListSecrets")),
	110	+	connect.WithClientOptions(opts...),
	111	+	),
	112	+	deleteSecret: connect.NewClient[ermite.DeleteSecretRequest, ermite.DeleteSecretResponse](
	113	+	httpClient,
	114	+	baseURL+SecretServiceDeleteSecretProcedure,
	115	+	connect.WithSchema(secretServiceMethods.ByName("DeleteSecret")),
	116	+	connect.WithClientOptions(opts...),
	117	+	),
	118	+	}
	119	+	}
	120	+
	121	+	// secretServiceClient implements SecretServiceClient.
	122	+	type secretServiceClient struct {
	123	+	setSecret *connect.Client[ermite.SetSecretRequest, ermite.SetSecretResponse]
	124	+	listSecrets *connect.Client[ermite.ListSecretsRequest, ermite.ListSecretsResponse]
	125	+	deleteSecret *connect.Client[ermite.DeleteSecretRequest, ermite.DeleteSecretResponse]
	126	+	}
	127	+
	128	+	// SetSecret calls ermite.SecretService.SetSecret.
	129	+	func (c secretServiceClient) SetSecret(ctx context.Context, req connect.Request[ermite.SetSecretRequest]) (*connect.Response[ermite.SetSecretResponse], error) {
	130	+	return c.setSecret.CallUnary(ctx, req)
	131	+	}
	132	+
	133	+	// ListSecrets calls ermite.SecretService.ListSecrets.
	134	+	func (c secretServiceClient) ListSecrets(ctx context.Context, req connect.Request[ermite.ListSecretsRequest]) (*connect.Response[ermite.ListSecretsResponse], error) {
	135	+	return c.listSecrets.CallUnary(ctx, req)
	136	+	}
	137	+
	138	+	// DeleteSecret calls ermite.SecretService.DeleteSecret.
	139	+	func (c secretServiceClient) DeleteSecret(ctx context.Context, req connect.Request[ermite.DeleteSecretRequest]) (*connect.Response[ermite.DeleteSecretResponse], error) {
	140	+	return c.deleteSecret.CallUnary(ctx, req)
	141	+	}
	142	+
	143	+	// SecretServiceHandler is an implementation of the ermite.SecretService service.
	144	+	type SecretServiceHandler interface {
	145	+	// SetSecret creates the secret or replaces its value. Fails with
	146	+	// invalid_argument if the name is not valid, if the value is empty or longer
	147	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	148	+	// environment of the scope does not exist, and with failed_precondition if
	149	+	// the server has no encryption key.
	150	+	SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error)
	151	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	152	+	// the secrets set in that scope, not the ones the scope inherits. It never
	153	+	// returns values.
	154	+	ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error)
	155	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	156	+	DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error)
	157	+	}
	158	+
	159	+	// NewSecretServiceHandler builds an HTTP handler from the service implementation. It returns the
	160	+	// path on which to mount the handler and the handler itself.
	161	+	//
	162	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	163	+	// and JSON codecs. They also support gzip compression.
	164	+	func NewSecretServiceHandler(svc SecretServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	165	+	secretServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("SecretService").Methods()
	166	+	secretServiceSetSecretHandler := connect.NewUnaryHandler(
	167	+	SecretServiceSetSecretProcedure,
	168	+	svc.SetSecret,
	169	+	connect.WithSchema(secretServiceMethods.ByName("SetSecret")),
	170	+	connect.WithHandlerOptions(opts...),
	171	+	)
	172	+	secretServiceListSecretsHandler := connect.NewUnaryHandler(
	173	+	SecretServiceListSecretsProcedure,
	174	+	svc.ListSecrets,
	175	+	connect.WithSchema(secretServiceMethods.ByName("ListSecrets")),
	176	+	connect.WithHandlerOptions(opts...),
	177	+	)
	178	+	secretServiceDeleteSecretHandler := connect.NewUnaryHandler(
	179	+	SecretServiceDeleteSecretProcedure,
	180	+	svc.DeleteSecret,
	181	+	connect.WithSchema(secretServiceMethods.ByName("DeleteSecret")),
	182	+	connect.WithHandlerOptions(opts...),
	183	+	)
	184	+	return "/ermite.SecretService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	185	+	switch r.URL.Path {
	186	+	case SecretServiceSetSecretProcedure:
	187	+	secretServiceSetSecretHandler.ServeHTTP(w, r)
	188	+	case SecretServiceListSecretsProcedure:
	189	+	secretServiceListSecretsHandler.ServeHTTP(w, r)
	190	+	case SecretServiceDeleteSecretProcedure:
	191	+	secretServiceDeleteSecretHandler.ServeHTTP(w, r)
	192	+	default:
	193	+	http.NotFound(w, r)
	194	+	}
	195	+	})
	196	+	}
	197	+
	198	+	// UnimplementedSecretServiceHandler returns CodeUnimplemented from all methods.
	199	+	type UnimplementedSecretServiceHandler struct{}
	200	+
	201	+	func (UnimplementedSecretServiceHandler) SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error) {
	202	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.SetSecret is not implemented"))
	203	+	}
	204	+
	205	+	func (UnimplementedSecretServiceHandler) ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error) {
	206	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.ListSecrets is not implemented"))
	207	+	}
	208	+
	209	+	func (UnimplementedSecretServiceHandler) DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error) {
	210	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.DeleteSecret is not implemented"))
	211	+	}
	212	+
	213	+	// VariableServiceClient is a client for the ermite.VariableService service.
	214	+	type VariableServiceClient interface {
	215	+	// SetVariable creates the variable or replaces its value. Fails with
	216	+	// invalid_argument if the name is not valid, if the value is longer than 48
	217	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	218	+	// environment of the scope does not exist. An empty value is allowed.
	219	+	SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error)
	220	+	// GetVariable returns one variable of one scope, with its value. Fails with
	221	+	// not_found if it does not exist in that scope.
	222	+	GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error)
	223	+	// ListVariables lists the variables of one scope, ordered by name, with
	224	+	// their values. It lists only the variables set in that scope.
	225	+	ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error)
	226	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	227	+	// exist.
	228	+	DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error)
	229	+	}
	230	+
	231	+	// NewVariableServiceClient constructs a client for the ermite.VariableService service. By default,
	232	+	// it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and
	233	+	// sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC()
	234	+	// or connect.WithGRPCWeb() options.
	235	+	//
	236	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	237	+	// http://api.acme.com or https://acme.com/grpc).
	238	+	func NewVariableServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) VariableServiceClient {
	239	+	baseURL = strings.TrimRight(baseURL, "/")
	240	+	variableServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("VariableService").Methods()
	241	+	return &variableServiceClient{
	242	+	setVariable: connect.NewClient[ermite.SetVariableRequest, ermite.SetVariableResponse](
	243	+	httpClient,
	244	+	baseURL+VariableServiceSetVariableProcedure,
	245	+	connect.WithSchema(variableServiceMethods.ByName("SetVariable")),
	246	+	connect.WithClientOptions(opts...),
	247	+	),
	248	+	getVariable: connect.NewClient[ermite.GetVariableRequest, ermite.GetVariableResponse](
	249	+	httpClient,
	250	+	baseURL+VariableServiceGetVariableProcedure,
	251	+	connect.WithSchema(variableServiceMethods.ByName("GetVariable")),
	252	+	connect.WithClientOptions(opts...),
	253	+	),
	254	+	listVariables: connect.NewClient[ermite.ListVariablesRequest, ermite.ListVariablesResponse](
	255	+	httpClient,
	256	+	baseURL+VariableServiceListVariablesProcedure,
	257	+	connect.WithSchema(variableServiceMethods.ByName("ListVariables")),
	258	+	connect.WithClientOptions(opts...),
	259	+	),
	260	+	deleteVariable: connect.NewClient[ermite.DeleteVariableRequest, ermite.DeleteVariableResponse](
	261	+	httpClient,
	262	+	baseURL+VariableServiceDeleteVariableProcedure,
	263	+	connect.WithSchema(variableServiceMethods.ByName("DeleteVariable")),
	264	+	connect.WithClientOptions(opts...),
	265	+	),
	266	+	}
	267	+	}
	268	+
	269	+	// variableServiceClient implements VariableServiceClient.
	270	+	type variableServiceClient struct {
	271	+	setVariable *connect.Client[ermite.SetVariableRequest, ermite.SetVariableResponse]
	272	+	getVariable *connect.Client[ermite.GetVariableRequest, ermite.GetVariableResponse]
	273	+	listVariables *connect.Client[ermite.ListVariablesRequest, ermite.ListVariablesResponse]
	274	+	deleteVariable *connect.Client[ermite.DeleteVariableRequest, ermite.DeleteVariableResponse]
	275	+	}
	276	+
	277	+	// SetVariable calls ermite.VariableService.SetVariable.
	278	+	func (c variableServiceClient) SetVariable(ctx context.Context, req connect.Request[ermite.SetVariableRequest]) (*connect.Response[ermite.SetVariableResponse], error) {
	279	+	return c.setVariable.CallUnary(ctx, req)
	280	+	}
	281	+
	282	+	// GetVariable calls ermite.VariableService.GetVariable.
	283	+	func (c variableServiceClient) GetVariable(ctx context.Context, req connect.Request[ermite.GetVariableRequest]) (*connect.Response[ermite.GetVariableResponse], error) {
	284	+	return c.getVariable.CallUnary(ctx, req)
	285	+	}
	286	+
	287	+	// ListVariables calls ermite.VariableService.ListVariables.
	288	+	func (c variableServiceClient) ListVariables(ctx context.Context, req connect.Request[ermite.ListVariablesRequest]) (*connect.Response[ermite.ListVariablesResponse], error) {
	289	+	return c.listVariables.CallUnary(ctx, req)
	290	+	}
	291	+
	292	+	// DeleteVariable calls ermite.VariableService.DeleteVariable.
	293	+	func (c variableServiceClient) DeleteVariable(ctx context.Context, req connect.Request[ermite.DeleteVariableRequest]) (*connect.Response[ermite.DeleteVariableResponse], error) {
	294	+	return c.deleteVariable.CallUnary(ctx, req)
	295	+	}
	296	+
	297	+	// VariableServiceHandler is an implementation of the ermite.VariableService service.
	298	+	type VariableServiceHandler interface {
	299	+	// SetVariable creates the variable or replaces its value. Fails with
	300	+	// invalid_argument if the name is not valid, if the value is longer than 48
	301	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	302	+	// environment of the scope does not exist. An empty value is allowed.
	303	+	SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error)
	304	+	// GetVariable returns one variable of one scope, with its value. Fails with
	305	+	// not_found if it does not exist in that scope.
	306	+	GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error)
	307	+	// ListVariables lists the variables of one scope, ordered by name, with
	308	+	// their values. It lists only the variables set in that scope.
	309	+	ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error)
	310	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	311	+	// exist.
	312	+	DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error)
	313	+	}
	314	+
	315	+	// NewVariableServiceHandler builds an HTTP handler from the service implementation. It returns the
	316	+	// path on which to mount the handler and the handler itself.
	317	+	//
	318	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	319	+	// and JSON codecs. They also support gzip compression.
	320	+	func NewVariableServiceHandler(svc VariableServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	321	+	variableServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("VariableService").Methods()
	322	+	variableServiceSetVariableHandler := connect.NewUnaryHandler(
	323	+	VariableServiceSetVariableProcedure,
	324	+	svc.SetVariable,
	325	+	connect.WithSchema(variableServiceMethods.ByName("SetVariable")),
	326	+	connect.WithHandlerOptions(opts...),
	327	+	)
	328	+	variableServiceGetVariableHandler := connect.NewUnaryHandler(
	329	+	VariableServiceGetVariableProcedure,
	330	+	svc.GetVariable,
	331	+	connect.WithSchema(variableServiceMethods.ByName("GetVariable")),
	332	+	connect.WithHandlerOptions(opts...),
	333	+	)
	334	+	variableServiceListVariablesHandler := connect.NewUnaryHandler(
	335	+	VariableServiceListVariablesProcedure,
	336	+	svc.ListVariables,
	337	+	connect.WithSchema(variableServiceMethods.ByName("ListVariables")),
	338	+	connect.WithHandlerOptions(opts...),
	339	+	)
	340	+	variableServiceDeleteVariableHandler := connect.NewUnaryHandler(
	341	+	VariableServiceDeleteVariableProcedure,
	342	+	svc.DeleteVariable,
	343	+	connect.WithSchema(variableServiceMethods.ByName("DeleteVariable")),
	344	+	connect.WithHandlerOptions(opts...),
	345	+	)
	346	+	return "/ermite.VariableService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	347	+	switch r.URL.Path {
	348	+	case VariableServiceSetVariableProcedure:
	349	+	variableServiceSetVariableHandler.ServeHTTP(w, r)
	350	+	case VariableServiceGetVariableProcedure:
	351	+	variableServiceGetVariableHandler.ServeHTTP(w, r)
	352	+	case VariableServiceListVariablesProcedure:
	353	+	variableServiceListVariablesHandler.ServeHTTP(w, r)
	354	+	case VariableServiceDeleteVariableProcedure:
	355	+	variableServiceDeleteVariableHandler.ServeHTTP(w, r)
	356	+	default:
	357	+	http.NotFound(w, r)
	358	+	}
	359	+	})
	360	+	}
	361	+
	362	+	// UnimplementedVariableServiceHandler returns CodeUnimplemented from all methods.
	363	+	type UnimplementedVariableServiceHandler struct{}
	364	+
	365	+	func (UnimplementedVariableServiceHandler) SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error) {
	366	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.SetVariable is not implemented"))
	367	+	}
	368	+
	369	+	func (UnimplementedVariableServiceHandler) GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error) {
	370	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.GetVariable is not implemented"))
	371	+	}
	372	+
	373	+	func (UnimplementedVariableServiceHandler) ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error) {
	374	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.ListVariables is not implemented"))
	375	+	}
	376	+
	377	+	func (UnimplementedVariableServiceHandler) DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error) {
	378	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.DeleteVariable is not implemented"))
	379	+	}
	380	+
	381	+	// EnvironmentServiceClient is a client for the ermite.EnvironmentService service.
	382	+	type EnvironmentServiceClient interface {
	383	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	384	+	// if the environment already exists (without regard to case), as GitHub's
	385	+	// create-or-update does. Fails with invalid_argument if the name is not
	386	+	// valid and with not_found if the repository does not exist.
	387	+	CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error)
	388	+	// ListEnvironments lists the environments of a repository, ordered by name.
	389	+	ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error)
	390	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	391	+	// Fails with not_found if it does not exist.
	392	+	DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error)
	393	+	}
	394	+
	395	+	// NewEnvironmentServiceClient constructs a client for the ermite.EnvironmentService service. By
	396	+	// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
	397	+	// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
	398	+	// connect.WithGRPC() or connect.WithGRPCWeb() options.
	399	+	//
	400	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	401	+	// http://api.acme.com or https://acme.com/grpc).
	402	+	func NewEnvironmentServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) EnvironmentServiceClient {
	403	+	baseURL = strings.TrimRight(baseURL, "/")
	404	+	environmentServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("EnvironmentService").Methods()
	405	+	return &environmentServiceClient{
	406	+	createEnvironment: connect.NewClient[ermite.CreateEnvironmentRequest, ermite.CreateEnvironmentResponse](
	407	+	httpClient,
	408	+	baseURL+EnvironmentServiceCreateEnvironmentProcedure,
	409	+	connect.WithSchema(environmentServiceMethods.ByName("CreateEnvironment")),
	410	+	connect.WithClientOptions(opts...),
	411	+	),
	412	+	listEnvironments: connect.NewClient[ermite.ListEnvironmentsRequest, ermite.ListEnvironmentsResponse](
	413	+	httpClient,
	414	+	baseURL+EnvironmentServiceListEnvironmentsProcedure,
	415	+	connect.WithSchema(environmentServiceMethods.ByName("ListEnvironments")),
	416	+	connect.WithClientOptions(opts...),
	417	+	),
	418	+	deleteEnvironment: connect.NewClient[ermite.DeleteEnvironmentRequest, ermite.DeleteEnvironmentResponse](
	419	+	httpClient,
	420	+	baseURL+EnvironmentServiceDeleteEnvironmentProcedure,
	421	+	connect.WithSchema(environmentServiceMethods.ByName("DeleteEnvironment")),
	422	+	connect.WithClientOptions(opts...),
	423	+	),
	424	+	}
	425	+	}
	426	+
	427	+	// environmentServiceClient implements EnvironmentServiceClient.
	428	+	type environmentServiceClient struct {
	429	+	createEnvironment *connect.Client[ermite.CreateEnvironmentRequest, ermite.CreateEnvironmentResponse]
	430	+	listEnvironments *connect.Client[ermite.ListEnvironmentsRequest, ermite.ListEnvironmentsResponse]
	431	+	deleteEnvironment *connect.Client[ermite.DeleteEnvironmentRequest, ermite.DeleteEnvironmentResponse]
	432	+	}
	433	+
	434	+	// CreateEnvironment calls ermite.EnvironmentService.CreateEnvironment.
	435	+	func (c environmentServiceClient) CreateEnvironment(ctx context.Context, req connect.Request[ermite.CreateEnvironmentRequest]) (*connect.Response[ermite.CreateEnvironmentResponse], error) {
	436	+	return c.createEnvironment.CallUnary(ctx, req)
	437	+	}
	438	+
	439	+	// ListEnvironments calls ermite.EnvironmentService.ListEnvironments.
	440	+	func (c environmentServiceClient) ListEnvironments(ctx context.Context, req connect.Request[ermite.ListEnvironmentsRequest]) (*connect.Response[ermite.ListEnvironmentsResponse], error) {
	441	+	return c.listEnvironments.CallUnary(ctx, req)
	442	+	}
	443	+
	444	+	// DeleteEnvironment calls ermite.EnvironmentService.DeleteEnvironment.
	445	+	func (c environmentServiceClient) DeleteEnvironment(ctx context.Context, req connect.Request[ermite.DeleteEnvironmentRequest]) (*connect.Response[ermite.DeleteEnvironmentResponse], error) {
	446	+	return c.deleteEnvironment.CallUnary(ctx, req)
	447	+	}
	448	+
	449	+	// EnvironmentServiceHandler is an implementation of the ermite.EnvironmentService service.
	450	+	type EnvironmentServiceHandler interface {
	451	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	452	+	// if the environment already exists (without regard to case), as GitHub's
	453	+	// create-or-update does. Fails with invalid_argument if the name is not
	454	+	// valid and with not_found if the repository does not exist.
	455	+	CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error)
	456	+	// ListEnvironments lists the environments of a repository, ordered by name.
	457	+	ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error)
	458	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	459	+	// Fails with not_found if it does not exist.
	460	+	DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error)
	461	+	}
	462	+
	463	+	// NewEnvironmentServiceHandler builds an HTTP handler from the service implementation. It returns
	464	+	// the path on which to mount the handler and the handler itself.
	465	+	//
	466	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	467	+	// and JSON codecs. They also support gzip compression.
	468	+	func NewEnvironmentServiceHandler(svc EnvironmentServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	469	+	environmentServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("EnvironmentService").Methods()
	470	+	environmentServiceCreateEnvironmentHandler := connect.NewUnaryHandler(
	471	+	EnvironmentServiceCreateEnvironmentProcedure,
	472	+	svc.CreateEnvironment,
	473	+	connect.WithSchema(environmentServiceMethods.ByName("CreateEnvironment")),
	474	+	connect.WithHandlerOptions(opts...),
	475	+	)
	476	+	environmentServiceListEnvironmentsHandler := connect.NewUnaryHandler(
	477	+	EnvironmentServiceListEnvironmentsProcedure,
	478	+	svc.ListEnvironments,
	479	+	connect.WithSchema(environmentServiceMethods.ByName("ListEnvironments")),
	480	+	connect.WithHandlerOptions(opts...),
	481	+	)
	482	+	environmentServiceDeleteEnvironmentHandler := connect.NewUnaryHandler(
	483	+	EnvironmentServiceDeleteEnvironmentProcedure,
	484	+	svc.DeleteEnvironment,
	485	+	connect.WithSchema(environmentServiceMethods.ByName("DeleteEnvironment")),
	486	+	connect.WithHandlerOptions(opts...),
	487	+	)
	488	+	return "/ermite.EnvironmentService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	489	+	switch r.URL.Path {
	490	+	case EnvironmentServiceCreateEnvironmentProcedure:
	491	+	environmentServiceCreateEnvironmentHandler.ServeHTTP(w, r)
	492	+	case EnvironmentServiceListEnvironmentsProcedure:
	493	+	environmentServiceListEnvironmentsHandler.ServeHTTP(w, r)
	494	+	case EnvironmentServiceDeleteEnvironmentProcedure:
	495	+	environmentServiceDeleteEnvironmentHandler.ServeHTTP(w, r)
	496	+	default:
	497	+	http.NotFound(w, r)
	498	+	}
	499	+	})
	500	+	}
	501	+
	502	+	// UnimplementedEnvironmentServiceHandler returns CodeUnimplemented from all methods.
	503	+	type UnimplementedEnvironmentServiceHandler struct{}
	504	+
	505	+	func (UnimplementedEnvironmentServiceHandler) CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error) {
	506	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.CreateEnvironment is not implemented"))
	507	+	}
	508	+
	509	+	func (UnimplementedEnvironmentServiceHandler) ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error) {
	510	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.ListEnvironments is not implemented"))
	511	+	}
	512	+
	513	+	func (UnimplementedEnvironmentServiceHandler) DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error) {
	514	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.DeleteEnvironment is not implemented"))
	515	+	}

@@ -0,0 +1,515 @@
	1	+	// SPDX-License-Identifier: MIT
	2	+
	3	+	// Code generated by protoc-gen-connect-go. DO NOT EDIT.
	4	+	//
	5	+	// Source: ermite/ci_settings.proto
	6	+
	7	+	package ermiteconnect
	8	+
	9	+	import (
	10	+	ermite "bnema.dev/ermite-api/gen/ermite"
	11	+	connect "connectrpc.com/connect"
	12	+	context "context"
	13	+	errors "errors"
	14	+	http "net/http"
	15	+	strings "strings"
	16	+	)
	17	+
	18	+	// This is a compile-time assertion to ensure that this generated file and the connect package are
	19	+	// compatible. If you get a compiler error that this constant is not defined, this code was
	20	+	// generated with a version of connect newer than the one compiled into your binary. You can fix the
	21	+	// problem by either regenerating this code with an older version of connect or updating the connect
	22	+	// version compiled into your binary.
	23	+	const _ = connect.IsAtLeastVersion1_13_0
	24	+
	25	+	const (
	26	+	// SecretServiceName is the fully-qualified name of the SecretService service.
	27	+	SecretServiceName = "ermite.SecretService"
	28	+	// VariableServiceName is the fully-qualified name of the VariableService service.
	29	+	VariableServiceName = "ermite.VariableService"
	30	+	// EnvironmentServiceName is the fully-qualified name of the EnvironmentService service.
	31	+	EnvironmentServiceName = "ermite.EnvironmentService"
	32	+	)
	33	+
	34	+	// These constants are the fully-qualified names of the RPCs defined in this package. They're
	35	+	// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
	36	+	//
	37	+	// Note that these are different from the fully-qualified method names used by
	38	+	// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
	39	+	// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
	40	+	// period.
	41	+	const (
	42	+	// SecretServiceSetSecretProcedure is the fully-qualified name of the SecretService's SetSecret RPC.
	43	+	SecretServiceSetSecretProcedure = "/ermite.SecretService/SetSecret"
	44	+	// SecretServiceListSecretsProcedure is the fully-qualified name of the SecretService's ListSecrets
	45	+	// RPC.
	46	+	SecretServiceListSecretsProcedure = "/ermite.SecretService/ListSecrets"
	47	+	// SecretServiceDeleteSecretProcedure is the fully-qualified name of the SecretService's
	48	+	// DeleteSecret RPC.
	49	+	SecretServiceDeleteSecretProcedure = "/ermite.SecretService/DeleteSecret"
	50	+	// VariableServiceSetVariableProcedure is the fully-qualified name of the VariableService's
	51	+	// SetVariable RPC.
	52	+	VariableServiceSetVariableProcedure = "/ermite.VariableService/SetVariable"
	53	+	// VariableServiceGetVariableProcedure is the fully-qualified name of the VariableService's
	54	+	// GetVariable RPC.
	55	+	VariableServiceGetVariableProcedure = "/ermite.VariableService/GetVariable"
	56	+	// VariableServiceListVariablesProcedure is the fully-qualified name of the VariableService's
	57	+	// ListVariables RPC.
	58	+	VariableServiceListVariablesProcedure = "/ermite.VariableService/ListVariables"
	59	+	// VariableServiceDeleteVariableProcedure is the fully-qualified name of the VariableService's
	60	+	// DeleteVariable RPC.
	61	+	VariableServiceDeleteVariableProcedure = "/ermite.VariableService/DeleteVariable"
	62	+	// EnvironmentServiceCreateEnvironmentProcedure is the fully-qualified name of the
	63	+	// EnvironmentService's CreateEnvironment RPC.
	64	+	EnvironmentServiceCreateEnvironmentProcedure = "/ermite.EnvironmentService/CreateEnvironment"
	65	+	// EnvironmentServiceListEnvironmentsProcedure is the fully-qualified name of the
	66	+	// EnvironmentService's ListEnvironments RPC.
	67	+	EnvironmentServiceListEnvironmentsProcedure = "/ermite.EnvironmentService/ListEnvironments"
	68	+	// EnvironmentServiceDeleteEnvironmentProcedure is the fully-qualified name of the
	69	+	// EnvironmentService's DeleteEnvironment RPC.
	70	+	EnvironmentServiceDeleteEnvironmentProcedure = "/ermite.EnvironmentService/DeleteEnvironment"
	71	+	)
	72	+
	73	+	// SecretServiceClient is a client for the ermite.SecretService service.
	74	+	type SecretServiceClient interface {
	75	+	// SetSecret creates the secret or replaces its value. Fails with
	76	+	// invalid_argument if the name is not valid, if the value is empty or longer
	77	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	78	+	// environment of the scope does not exist, and with failed_precondition if
	79	+	// the server has no encryption key.
	80	+	SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error)
	81	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	82	+	// the secrets set in that scope, not the ones the scope inherits. It never
	83	+	// returns values.
	84	+	ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error)
	85	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	86	+	DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error)
	87	+	}
	88	+
	89	+	// NewSecretServiceClient constructs a client for the ermite.SecretService service. By default, it
	90	+	// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
	91	+	// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
	92	+	// connect.WithGRPCWeb() options.
	93	+	//
	94	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	95	+	// http://api.acme.com or https://acme.com/grpc).
	96	+	func NewSecretServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) SecretServiceClient {
	97	+	baseURL = strings.TrimRight(baseURL, "/")
	98	+	secretServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("SecretService").Methods()
	99	+	return &secretServiceClient{
	100	+	setSecret: connect.NewClient[ermite.SetSecretRequest, ermite.SetSecretResponse](
	101	+	httpClient,
	102	+	baseURL+SecretServiceSetSecretProcedure,
	103	+	connect.WithSchema(secretServiceMethods.ByName("SetSecret")),
	104	+	connect.WithClientOptions(opts...),
	105	+	),
	106	+	listSecrets: connect.NewClient[ermite.ListSecretsRequest, ermite.ListSecretsResponse](
	107	+	httpClient,
	108	+	baseURL+SecretServiceListSecretsProcedure,
	109	+	connect.WithSchema(secretServiceMethods.ByName("ListSecrets")),
	110	+	connect.WithClientOptions(opts...),
	111	+	),
	112	+	deleteSecret: connect.NewClient[ermite.DeleteSecretRequest, ermite.DeleteSecretResponse](
	113	+	httpClient,
	114	+	baseURL+SecretServiceDeleteSecretProcedure,
	115	+	connect.WithSchema(secretServiceMethods.ByName("DeleteSecret")),
	116	+	connect.WithClientOptions(opts...),
	117	+	),
	118	+	}
	119	+	}
	120	+
	121	+	// secretServiceClient implements SecretServiceClient.
	122	+	type secretServiceClient struct {
	123	+	setSecret *connect.Client[ermite.SetSecretRequest, ermite.SetSecretResponse]
	124	+	listSecrets *connect.Client[ermite.ListSecretsRequest, ermite.ListSecretsResponse]
	125	+	deleteSecret *connect.Client[ermite.DeleteSecretRequest, ermite.DeleteSecretResponse]
	126	+	}
	127	+
	128	+	// SetSecret calls ermite.SecretService.SetSecret.
	129	+	func (c secretServiceClient) SetSecret(ctx context.Context, req connect.Request[ermite.SetSecretRequest]) (*connect.Response[ermite.SetSecretResponse], error) {
	130	+	return c.setSecret.CallUnary(ctx, req)
	131	+	}
	132	+
	133	+	// ListSecrets calls ermite.SecretService.ListSecrets.
	134	+	func (c secretServiceClient) ListSecrets(ctx context.Context, req connect.Request[ermite.ListSecretsRequest]) (*connect.Response[ermite.ListSecretsResponse], error) {
	135	+	return c.listSecrets.CallUnary(ctx, req)
	136	+	}
	137	+
	138	+	// DeleteSecret calls ermite.SecretService.DeleteSecret.
	139	+	func (c secretServiceClient) DeleteSecret(ctx context.Context, req connect.Request[ermite.DeleteSecretRequest]) (*connect.Response[ermite.DeleteSecretResponse], error) {
	140	+	return c.deleteSecret.CallUnary(ctx, req)
	141	+	}
	142	+
	143	+	// SecretServiceHandler is an implementation of the ermite.SecretService service.
	144	+	type SecretServiceHandler interface {
	145	+	// SetSecret creates the secret or replaces its value. Fails with
	146	+	// invalid_argument if the name is not valid, if the value is empty or longer
	147	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	148	+	// environment of the scope does not exist, and with failed_precondition if
	149	+	// the server has no encryption key.
	150	+	SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error)
	151	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	152	+	// the secrets set in that scope, not the ones the scope inherits. It never
	153	+	// returns values.
	154	+	ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error)
	155	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	156	+	DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error)
	157	+	}
	158	+
	159	+	// NewSecretServiceHandler builds an HTTP handler from the service implementation. It returns the
	160	+	// path on which to mount the handler and the handler itself.
	161	+	//
	162	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	163	+	// and JSON codecs. They also support gzip compression.
	164	+	func NewSecretServiceHandler(svc SecretServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	165	+	secretServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("SecretService").Methods()
	166	+	secretServiceSetSecretHandler := connect.NewUnaryHandler(
	167	+	SecretServiceSetSecretProcedure,
	168	+	svc.SetSecret,
	169	+	connect.WithSchema(secretServiceMethods.ByName("SetSecret")),
	170	+	connect.WithHandlerOptions(opts...),
	171	+	)
	172	+	secretServiceListSecretsHandler := connect.NewUnaryHandler(
	173	+	SecretServiceListSecretsProcedure,
	174	+	svc.ListSecrets,
	175	+	connect.WithSchema(secretServiceMethods.ByName("ListSecrets")),
	176	+	connect.WithHandlerOptions(opts...),
	177	+	)
	178	+	secretServiceDeleteSecretHandler := connect.NewUnaryHandler(
	179	+	SecretServiceDeleteSecretProcedure,
	180	+	svc.DeleteSecret,
	181	+	connect.WithSchema(secretServiceMethods.ByName("DeleteSecret")),
	182	+	connect.WithHandlerOptions(opts...),
	183	+	)
	184	+	return "/ermite.SecretService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	185	+	switch r.URL.Path {
	186	+	case SecretServiceSetSecretProcedure:
	187	+	secretServiceSetSecretHandler.ServeHTTP(w, r)
	188	+	case SecretServiceListSecretsProcedure:
	189	+	secretServiceListSecretsHandler.ServeHTTP(w, r)
	190	+	case SecretServiceDeleteSecretProcedure:
	191	+	secretServiceDeleteSecretHandler.ServeHTTP(w, r)
	192	+	default:
	193	+	http.NotFound(w, r)
	194	+	}
	195	+	})
	196	+	}
	197	+
	198	+	// UnimplementedSecretServiceHandler returns CodeUnimplemented from all methods.
	199	+	type UnimplementedSecretServiceHandler struct{}
	200	+
	201	+	func (UnimplementedSecretServiceHandler) SetSecret(context.Context, connect.Request[ermite.SetSecretRequest]) (connect.Response[ermite.SetSecretResponse], error) {
	202	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.SetSecret is not implemented"))
	203	+	}
	204	+
	205	+	func (UnimplementedSecretServiceHandler) ListSecrets(context.Context, connect.Request[ermite.ListSecretsRequest]) (connect.Response[ermite.ListSecretsResponse], error) {
	206	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.ListSecrets is not implemented"))
	207	+	}
	208	+
	209	+	func (UnimplementedSecretServiceHandler) DeleteSecret(context.Context, connect.Request[ermite.DeleteSecretRequest]) (connect.Response[ermite.DeleteSecretResponse], error) {
	210	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.SecretService.DeleteSecret is not implemented"))
	211	+	}
	212	+
	213	+	// VariableServiceClient is a client for the ermite.VariableService service.
	214	+	type VariableServiceClient interface {
	215	+	// SetVariable creates the variable or replaces its value. Fails with
	216	+	// invalid_argument if the name is not valid, if the value is longer than 48
	217	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	218	+	// environment of the scope does not exist. An empty value is allowed.
	219	+	SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error)
	220	+	// GetVariable returns one variable of one scope, with its value. Fails with
	221	+	// not_found if it does not exist in that scope.
	222	+	GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error)
	223	+	// ListVariables lists the variables of one scope, ordered by name, with
	224	+	// their values. It lists only the variables set in that scope.
	225	+	ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error)
	226	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	227	+	// exist.
	228	+	DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error)
	229	+	}
	230	+
	231	+	// NewVariableServiceClient constructs a client for the ermite.VariableService service. By default,
	232	+	// it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and
	233	+	// sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC()
	234	+	// or connect.WithGRPCWeb() options.
	235	+	//
	236	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	237	+	// http://api.acme.com or https://acme.com/grpc).
	238	+	func NewVariableServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) VariableServiceClient {
	239	+	baseURL = strings.TrimRight(baseURL, "/")
	240	+	variableServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("VariableService").Methods()
	241	+	return &variableServiceClient{
	242	+	setVariable: connect.NewClient[ermite.SetVariableRequest, ermite.SetVariableResponse](
	243	+	httpClient,
	244	+	baseURL+VariableServiceSetVariableProcedure,
	245	+	connect.WithSchema(variableServiceMethods.ByName("SetVariable")),
	246	+	connect.WithClientOptions(opts...),
	247	+	),
	248	+	getVariable: connect.NewClient[ermite.GetVariableRequest, ermite.GetVariableResponse](
	249	+	httpClient,
	250	+	baseURL+VariableServiceGetVariableProcedure,
	251	+	connect.WithSchema(variableServiceMethods.ByName("GetVariable")),
	252	+	connect.WithClientOptions(opts...),
	253	+	),
	254	+	listVariables: connect.NewClient[ermite.ListVariablesRequest, ermite.ListVariablesResponse](
	255	+	httpClient,
	256	+	baseURL+VariableServiceListVariablesProcedure,
	257	+	connect.WithSchema(variableServiceMethods.ByName("ListVariables")),
	258	+	connect.WithClientOptions(opts...),
	259	+	),
	260	+	deleteVariable: connect.NewClient[ermite.DeleteVariableRequest, ermite.DeleteVariableResponse](
	261	+	httpClient,
	262	+	baseURL+VariableServiceDeleteVariableProcedure,
	263	+	connect.WithSchema(variableServiceMethods.ByName("DeleteVariable")),
	264	+	connect.WithClientOptions(opts...),
	265	+	),
	266	+	}
	267	+	}
	268	+
	269	+	// variableServiceClient implements VariableServiceClient.
	270	+	type variableServiceClient struct {
	271	+	setVariable *connect.Client[ermite.SetVariableRequest, ermite.SetVariableResponse]
	272	+	getVariable *connect.Client[ermite.GetVariableRequest, ermite.GetVariableResponse]
	273	+	listVariables *connect.Client[ermite.ListVariablesRequest, ermite.ListVariablesResponse]
	274	+	deleteVariable *connect.Client[ermite.DeleteVariableRequest, ermite.DeleteVariableResponse]
	275	+	}
	276	+
	277	+	// SetVariable calls ermite.VariableService.SetVariable.
	278	+	func (c variableServiceClient) SetVariable(ctx context.Context, req connect.Request[ermite.SetVariableRequest]) (*connect.Response[ermite.SetVariableResponse], error) {
	279	+	return c.setVariable.CallUnary(ctx, req)
	280	+	}
	281	+
	282	+	// GetVariable calls ermite.VariableService.GetVariable.
	283	+	func (c variableServiceClient) GetVariable(ctx context.Context, req connect.Request[ermite.GetVariableRequest]) (*connect.Response[ermite.GetVariableResponse], error) {
	284	+	return c.getVariable.CallUnary(ctx, req)
	285	+	}
	286	+
	287	+	// ListVariables calls ermite.VariableService.ListVariables.
	288	+	func (c variableServiceClient) ListVariables(ctx context.Context, req connect.Request[ermite.ListVariablesRequest]) (*connect.Response[ermite.ListVariablesResponse], error) {
	289	+	return c.listVariables.CallUnary(ctx, req)
	290	+	}
	291	+
	292	+	// DeleteVariable calls ermite.VariableService.DeleteVariable.
	293	+	func (c variableServiceClient) DeleteVariable(ctx context.Context, req connect.Request[ermite.DeleteVariableRequest]) (*connect.Response[ermite.DeleteVariableResponse], error) {
	294	+	return c.deleteVariable.CallUnary(ctx, req)
	295	+	}
	296	+
	297	+	// VariableServiceHandler is an implementation of the ermite.VariableService service.
	298	+	type VariableServiceHandler interface {
	299	+	// SetVariable creates the variable or replaces its value. Fails with
	300	+	// invalid_argument if the name is not valid, if the value is longer than 48
	301	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	302	+	// environment of the scope does not exist. An empty value is allowed.
	303	+	SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error)
	304	+	// GetVariable returns one variable of one scope, with its value. Fails with
	305	+	// not_found if it does not exist in that scope.
	306	+	GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error)
	307	+	// ListVariables lists the variables of one scope, ordered by name, with
	308	+	// their values. It lists only the variables set in that scope.
	309	+	ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error)
	310	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	311	+	// exist.
	312	+	DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error)
	313	+	}
	314	+
	315	+	// NewVariableServiceHandler builds an HTTP handler from the service implementation. It returns the
	316	+	// path on which to mount the handler and the handler itself.
	317	+	//
	318	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	319	+	// and JSON codecs. They also support gzip compression.
	320	+	func NewVariableServiceHandler(svc VariableServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	321	+	variableServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("VariableService").Methods()
	322	+	variableServiceSetVariableHandler := connect.NewUnaryHandler(
	323	+	VariableServiceSetVariableProcedure,
	324	+	svc.SetVariable,
	325	+	connect.WithSchema(variableServiceMethods.ByName("SetVariable")),
	326	+	connect.WithHandlerOptions(opts...),
	327	+	)
	328	+	variableServiceGetVariableHandler := connect.NewUnaryHandler(
	329	+	VariableServiceGetVariableProcedure,
	330	+	svc.GetVariable,
	331	+	connect.WithSchema(variableServiceMethods.ByName("GetVariable")),
	332	+	connect.WithHandlerOptions(opts...),
	333	+	)
	334	+	variableServiceListVariablesHandler := connect.NewUnaryHandler(
	335	+	VariableServiceListVariablesProcedure,
	336	+	svc.ListVariables,
	337	+	connect.WithSchema(variableServiceMethods.ByName("ListVariables")),
	338	+	connect.WithHandlerOptions(opts...),
	339	+	)
	340	+	variableServiceDeleteVariableHandler := connect.NewUnaryHandler(
	341	+	VariableServiceDeleteVariableProcedure,
	342	+	svc.DeleteVariable,
	343	+	connect.WithSchema(variableServiceMethods.ByName("DeleteVariable")),
	344	+	connect.WithHandlerOptions(opts...),
	345	+	)
	346	+	return "/ermite.VariableService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	347	+	switch r.URL.Path {
	348	+	case VariableServiceSetVariableProcedure:
	349	+	variableServiceSetVariableHandler.ServeHTTP(w, r)
	350	+	case VariableServiceGetVariableProcedure:
	351	+	variableServiceGetVariableHandler.ServeHTTP(w, r)
	352	+	case VariableServiceListVariablesProcedure:
	353	+	variableServiceListVariablesHandler.ServeHTTP(w, r)
	354	+	case VariableServiceDeleteVariableProcedure:
	355	+	variableServiceDeleteVariableHandler.ServeHTTP(w, r)
	356	+	default:
	357	+	http.NotFound(w, r)
	358	+	}
	359	+	})
	360	+	}
	361	+
	362	+	// UnimplementedVariableServiceHandler returns CodeUnimplemented from all methods.
	363	+	type UnimplementedVariableServiceHandler struct{}
	364	+
	365	+	func (UnimplementedVariableServiceHandler) SetVariable(context.Context, connect.Request[ermite.SetVariableRequest]) (connect.Response[ermite.SetVariableResponse], error) {
	366	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.SetVariable is not implemented"))
	367	+	}
	368	+
	369	+	func (UnimplementedVariableServiceHandler) GetVariable(context.Context, connect.Request[ermite.GetVariableRequest]) (connect.Response[ermite.GetVariableResponse], error) {
	370	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.GetVariable is not implemented"))
	371	+	}
	372	+
	373	+	func (UnimplementedVariableServiceHandler) ListVariables(context.Context, connect.Request[ermite.ListVariablesRequest]) (connect.Response[ermite.ListVariablesResponse], error) {
	374	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.ListVariables is not implemented"))
	375	+	}
	376	+
	377	+	func (UnimplementedVariableServiceHandler) DeleteVariable(context.Context, connect.Request[ermite.DeleteVariableRequest]) (connect.Response[ermite.DeleteVariableResponse], error) {
	378	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.VariableService.DeleteVariable is not implemented"))
	379	+	}
	380	+
	381	+	// EnvironmentServiceClient is a client for the ermite.EnvironmentService service.
	382	+	type EnvironmentServiceClient interface {
	383	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	384	+	// if the environment already exists (without regard to case), as GitHub's
	385	+	// create-or-update does. Fails with invalid_argument if the name is not
	386	+	// valid and with not_found if the repository does not exist.
	387	+	CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error)
	388	+	// ListEnvironments lists the environments of a repository, ordered by name.
	389	+	ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error)
	390	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	391	+	// Fails with not_found if it does not exist.
	392	+	DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error)
	393	+	}
	394	+
	395	+	// NewEnvironmentServiceClient constructs a client for the ermite.EnvironmentService service. By
	396	+	// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
	397	+	// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
	398	+	// connect.WithGRPC() or connect.WithGRPCWeb() options.
	399	+	//
	400	+	// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
	401	+	// http://api.acme.com or https://acme.com/grpc).
	402	+	func NewEnvironmentServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) EnvironmentServiceClient {
	403	+	baseURL = strings.TrimRight(baseURL, "/")
	404	+	environmentServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("EnvironmentService").Methods()
	405	+	return &environmentServiceClient{
	406	+	createEnvironment: connect.NewClient[ermite.CreateEnvironmentRequest, ermite.CreateEnvironmentResponse](
	407	+	httpClient,
	408	+	baseURL+EnvironmentServiceCreateEnvironmentProcedure,
	409	+	connect.WithSchema(environmentServiceMethods.ByName("CreateEnvironment")),
	410	+	connect.WithClientOptions(opts...),
	411	+	),
	412	+	listEnvironments: connect.NewClient[ermite.ListEnvironmentsRequest, ermite.ListEnvironmentsResponse](
	413	+	httpClient,
	414	+	baseURL+EnvironmentServiceListEnvironmentsProcedure,
	415	+	connect.WithSchema(environmentServiceMethods.ByName("ListEnvironments")),
	416	+	connect.WithClientOptions(opts...),
	417	+	),
	418	+	deleteEnvironment: connect.NewClient[ermite.DeleteEnvironmentRequest, ermite.DeleteEnvironmentResponse](
	419	+	httpClient,
	420	+	baseURL+EnvironmentServiceDeleteEnvironmentProcedure,
	421	+	connect.WithSchema(environmentServiceMethods.ByName("DeleteEnvironment")),
	422	+	connect.WithClientOptions(opts...),
	423	+	),
	424	+	}
	425	+	}
	426	+
	427	+	// environmentServiceClient implements EnvironmentServiceClient.
	428	+	type environmentServiceClient struct {
	429	+	createEnvironment *connect.Client[ermite.CreateEnvironmentRequest, ermite.CreateEnvironmentResponse]
	430	+	listEnvironments *connect.Client[ermite.ListEnvironmentsRequest, ermite.ListEnvironmentsResponse]
	431	+	deleteEnvironment *connect.Client[ermite.DeleteEnvironmentRequest, ermite.DeleteEnvironmentResponse]
	432	+	}
	433	+
	434	+	// CreateEnvironment calls ermite.EnvironmentService.CreateEnvironment.
	435	+	func (c environmentServiceClient) CreateEnvironment(ctx context.Context, req connect.Request[ermite.CreateEnvironmentRequest]) (*connect.Response[ermite.CreateEnvironmentResponse], error) {
	436	+	return c.createEnvironment.CallUnary(ctx, req)
	437	+	}
	438	+
	439	+	// ListEnvironments calls ermite.EnvironmentService.ListEnvironments.
	440	+	func (c environmentServiceClient) ListEnvironments(ctx context.Context, req connect.Request[ermite.ListEnvironmentsRequest]) (*connect.Response[ermite.ListEnvironmentsResponse], error) {
	441	+	return c.listEnvironments.CallUnary(ctx, req)
	442	+	}
	443	+
	444	+	// DeleteEnvironment calls ermite.EnvironmentService.DeleteEnvironment.
	445	+	func (c environmentServiceClient) DeleteEnvironment(ctx context.Context, req connect.Request[ermite.DeleteEnvironmentRequest]) (*connect.Response[ermite.DeleteEnvironmentResponse], error) {
	446	+	return c.deleteEnvironment.CallUnary(ctx, req)
	447	+	}
	448	+
	449	+	// EnvironmentServiceHandler is an implementation of the ermite.EnvironmentService service.
	450	+	type EnvironmentServiceHandler interface {
	451	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	452	+	// if the environment already exists (without regard to case), as GitHub's
	453	+	// create-or-update does. Fails with invalid_argument if the name is not
	454	+	// valid and with not_found if the repository does not exist.
	455	+	CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error)
	456	+	// ListEnvironments lists the environments of a repository, ordered by name.
	457	+	ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error)
	458	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	459	+	// Fails with not_found if it does not exist.
	460	+	DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error)
	461	+	}
	462	+
	463	+	// NewEnvironmentServiceHandler builds an HTTP handler from the service implementation. It returns
	464	+	// the path on which to mount the handler and the handler itself.
	465	+	//
	466	+	// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
	467	+	// and JSON codecs. They also support gzip compression.
	468	+	func NewEnvironmentServiceHandler(svc EnvironmentServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	469	+	environmentServiceMethods := ermite.File_ermite_ci_settings_proto.Services().ByName("EnvironmentService").Methods()
	470	+	environmentServiceCreateEnvironmentHandler := connect.NewUnaryHandler(
	471	+	EnvironmentServiceCreateEnvironmentProcedure,
	472	+	svc.CreateEnvironment,
	473	+	connect.WithSchema(environmentServiceMethods.ByName("CreateEnvironment")),
	474	+	connect.WithHandlerOptions(opts...),
	475	+	)
	476	+	environmentServiceListEnvironmentsHandler := connect.NewUnaryHandler(
	477	+	EnvironmentServiceListEnvironmentsProcedure,
	478	+	svc.ListEnvironments,
	479	+	connect.WithSchema(environmentServiceMethods.ByName("ListEnvironments")),
	480	+	connect.WithHandlerOptions(opts...),
	481	+	)
	482	+	environmentServiceDeleteEnvironmentHandler := connect.NewUnaryHandler(
	483	+	EnvironmentServiceDeleteEnvironmentProcedure,
	484	+	svc.DeleteEnvironment,
	485	+	connect.WithSchema(environmentServiceMethods.ByName("DeleteEnvironment")),
	486	+	connect.WithHandlerOptions(opts...),
	487	+	)
	488	+	return "/ermite.EnvironmentService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	489	+	switch r.URL.Path {
	490	+	case EnvironmentServiceCreateEnvironmentProcedure:
	491	+	environmentServiceCreateEnvironmentHandler.ServeHTTP(w, r)
	492	+	case EnvironmentServiceListEnvironmentsProcedure:
	493	+	environmentServiceListEnvironmentsHandler.ServeHTTP(w, r)
	494	+	case EnvironmentServiceDeleteEnvironmentProcedure:
	495	+	environmentServiceDeleteEnvironmentHandler.ServeHTTP(w, r)
	496	+	default:
	497	+	http.NotFound(w, r)
	498	+	}
	499	+	})
	500	+	}
	501	+
	502	+	// UnimplementedEnvironmentServiceHandler returns CodeUnimplemented from all methods.
	503	+	type UnimplementedEnvironmentServiceHandler struct{}
	504	+
	505	+	func (UnimplementedEnvironmentServiceHandler) CreateEnvironment(context.Context, connect.Request[ermite.CreateEnvironmentRequest]) (connect.Response[ermite.CreateEnvironmentResponse], error) {
	506	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.CreateEnvironment is not implemented"))
	507	+	}
	508	+
	509	+	func (UnimplementedEnvironmentServiceHandler) ListEnvironments(context.Context, connect.Request[ermite.ListEnvironmentsRequest]) (connect.Response[ermite.ListEnvironmentsResponse], error) {
	510	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.ListEnvironments is not implemented"))
	511	+	}
	512	+
	513	+	func (UnimplementedEnvironmentServiceHandler) DeleteEnvironment(context.Context, connect.Request[ermite.DeleteEnvironmentRequest]) (connect.Response[ermite.DeleteEnvironmentResponse], error) {
	514	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.EnvironmentService.DeleteEnvironment is not implemented"))
	515	+	}

M gen/ermite/ermiteconnect/run.connect.go +57 -0


@@ -53,6 +53,9 @@ const (
53	53		RunServiceCancelRunProcedure = "/ermite.RunService/CancelRun"
54	54		// RunServiceRerunRunProcedure is the fully-qualified name of the RunService's RerunRun RPC.
55	55		RunServiceRerunRunProcedure = "/ermite.RunService/RerunRun"
	56	+	// RunServiceDispatchWorkflowProcedure is the fully-qualified name of the RunService's
	57	+	// DispatchWorkflow RPC.
	58	+	RunServiceDispatchWorkflowProcedure = "/ermite.RunService/DispatchWorkflow"
56	59		// RunServiceListChecksProcedure is the fully-qualified name of the RunService's ListChecks RPC.
57	60		RunServiceListChecksProcedure = "/ermite.RunService/ListChecks"
58	61		// RunServiceListRunnersProcedure is the fully-qualified name of the RunService's ListRunners RPC.

@@ -127,6 +130,21 @@ type RunServiceClient interface {
127	130		// with failed_precondition if the latest attempt has not completed, or if
128	131		// failed_only is set and no job failed. The new attempt is returned QUEUED.
129	132		RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)
	133	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
	134	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
	135	+	// scope on the repository. The workflow is read at ref and must have
	136	+	// "workflow_dispatch" among its events. The run has event
	137	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
	138	+	// actor; it is trusted when the caller is the owner and not trusted when the
	139	+	// caller is a token limited to branches. The run is returned QUEUED, before
	140	+	// any job has been given to a runner. Only servers with the feature
	141	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
	142	+	// not_found if the repository, the workflow file or ref does not exist,
	143	+	// with failed_precondition if the workflow does not declare
	144	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
	145	+	// missing while required without default, or has a value of the wrong type
	146	+	// or outside its choices, or if the workflow file is not valid.
	147	+	DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error)
130	148		// ListChecks lists the checks of a commit: for each job of each run on that
131	149		// sha, the one of the latest attempt, ordered by creation time then name.
132	150		// A commit without a run has no check: the list is empty, which is not an

@@ -203,6 +221,12 @@ func NewRunServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...
203	221		connect.WithSchema(runServiceMethods.ByName("RerunRun")),
204	222		connect.WithClientOptions(opts...),
205	223		),
	224	+	dispatchWorkflow: connect.NewClient[ermite.DispatchWorkflowRequest, ermite.DispatchWorkflowResponse](
	225	+	httpClient,
	226	+	baseURL+RunServiceDispatchWorkflowProcedure,
	227	+	connect.WithSchema(runServiceMethods.ByName("DispatchWorkflow")),
	228	+	connect.WithClientOptions(opts...),
	229	+	),
206	230		listChecks: connect.NewClient[ermite.ListChecksRequest, ermite.ListChecksResponse](
207	231		httpClient,
208	232		baseURL+RunServiceListChecksProcedure,

@@ -234,6 +258,7 @@ type runServiceClient struct {
234	258		getJobLog *connect.Client[ermite.GetJobLogRequest, ermite.GetJobLogResponse]
235	259		cancelRun *connect.Client[ermite.CancelRunRequest, ermite.CancelRunResponse]
236	260		rerunRun *connect.Client[ermite.RerunRunRequest, ermite.RerunRunResponse]
	261	+	dispatchWorkflow *connect.Client[ermite.DispatchWorkflowRequest, ermite.DispatchWorkflowResponse]
237	262		listChecks *connect.Client[ermite.ListChecksRequest, ermite.ListChecksResponse]
238	263		listRunners *connect.Client[ermite.ListRunnersRequest, ermite.ListRunnersResponse]
239	264		removeRunner *connect.Client[ermite.RemoveRunnerRequest, ermite.RemoveRunnerResponse]

@@ -279,6 +304,11 @@ func (c runServiceClient) RerunRun(ctx context.Context, req connect.Request[er
279	304		return c.rerunRun.CallUnary(ctx, req)
280	305		}
281	306
	307	+	// DispatchWorkflow calls ermite.RunService.DispatchWorkflow.
	308	+	func (c runServiceClient) DispatchWorkflow(ctx context.Context, req connect.Request[ermite.DispatchWorkflowRequest]) (*connect.Response[ermite.DispatchWorkflowResponse], error) {
	309	+	return c.dispatchWorkflow.CallUnary(ctx, req)
	310	+	}
	311	+
282	312		// ListChecks calls ermite.RunService.ListChecks.
283	313		func (c runServiceClient) ListChecks(ctx context.Context, req connect.Request[ermite.ListChecksRequest]) (*connect.Response[ermite.ListChecksResponse], error) {
284	314		return c.listChecks.CallUnary(ctx, req)

@@ -360,6 +390,21 @@ type RunServiceHandler interface {
360	390		// with failed_precondition if the latest attempt has not completed, or if
361	391		// failed_only is set and no job failed. The new attempt is returned QUEUED.
362	392		RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)
	393	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
	394	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
	395	+	// scope on the repository. The workflow is read at ref and must have
	396	+	// "workflow_dispatch" among its events. The run has event
	397	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
	398	+	// actor; it is trusted when the caller is the owner and not trusted when the
	399	+	// caller is a token limited to branches. The run is returned QUEUED, before
	400	+	// any job has been given to a runner. Only servers with the feature
	401	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
	402	+	// not_found if the repository, the workflow file or ref does not exist,
	403	+	// with failed_precondition if the workflow does not declare
	404	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
	405	+	// missing while required without default, or has a value of the wrong type
	406	+	// or outside its choices, or if the workflow file is not valid.
	407	+	DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error)
363	408		// ListChecks lists the checks of a commit: for each job of each run on that
364	409		// sha, the one of the latest attempt, ordered by creation time then name.
365	410		// A commit without a run has no check: the list is empty, which is not an

@@ -432,6 +477,12 @@ func NewRunServiceHandler(svc RunServiceHandler, opts ...connect.HandlerOption)
432	477		connect.WithSchema(runServiceMethods.ByName("RerunRun")),
433	478		connect.WithHandlerOptions(opts...),
434	479		)
	480	+	runServiceDispatchWorkflowHandler := connect.NewUnaryHandler(
	481	+	RunServiceDispatchWorkflowProcedure,
	482	+	svc.DispatchWorkflow,
	483	+	connect.WithSchema(runServiceMethods.ByName("DispatchWorkflow")),
	484	+	connect.WithHandlerOptions(opts...),
	485	+	)
435	486		runServiceListChecksHandler := connect.NewUnaryHandler(
436	487		RunServiceListChecksProcedure,
437	488		svc.ListChecks,

@@ -468,6 +519,8 @@ func NewRunServiceHandler(svc RunServiceHandler, opts ...connect.HandlerOption)
468	519		runServiceCancelRunHandler.ServeHTTP(w, r)
469	520		case RunServiceRerunRunProcedure:
470	521		runServiceRerunRunHandler.ServeHTTP(w, r)
	522	+	case RunServiceDispatchWorkflowProcedure:
	523	+	runServiceDispatchWorkflowHandler.ServeHTTP(w, r)
471	524		case RunServiceListChecksProcedure:
472	525		runServiceListChecksHandler.ServeHTTP(w, r)
473	526		case RunServiceListRunnersProcedure:

@@ -515,6 +568,10 @@ func (UnimplementedRunServiceHandler) RerunRun(context.Context, *connect.Request
515	568		return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.RerunRun is not implemented"))
516	569		}
517	570
	571	+	func (UnimplementedRunServiceHandler) DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error) {
	572	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.DispatchWorkflow is not implemented"))
	573	+	}
	574	+
518	575		func (UnimplementedRunServiceHandler) ListChecks(context.Context, connect.Request[ermite.ListChecksRequest]) (connect.Response[ermite.ListChecksResponse], error) {
519	576		return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.ListChecks is not implemented"))
520	577		}


@@ -53,6 +53,9 @@ const (
53	RunServiceCancelRunProcedure = "/ermite.RunService/CancelRun"	53		RunServiceCancelRunProcedure = "/ermite.RunService/CancelRun"
54	// RunServiceRerunRunProcedure is the fully-qualified name of the RunService's RerunRun RPC.	54		// RunServiceRerunRunProcedure is the fully-qualified name of the RunService's RerunRun RPC.
55	RunServiceRerunRunProcedure = "/ermite.RunService/RerunRun"	55		RunServiceRerunRunProcedure = "/ermite.RunService/RerunRun"
		56	+	// RunServiceDispatchWorkflowProcedure is the fully-qualified name of the RunService's
		57	+	// DispatchWorkflow RPC.
		58	+	RunServiceDispatchWorkflowProcedure = "/ermite.RunService/DispatchWorkflow"
56	// RunServiceListChecksProcedure is the fully-qualified name of the RunService's ListChecks RPC.	59		// RunServiceListChecksProcedure is the fully-qualified name of the RunService's ListChecks RPC.
57	RunServiceListChecksProcedure = "/ermite.RunService/ListChecks"	60		RunServiceListChecksProcedure = "/ermite.RunService/ListChecks"
58	// RunServiceListRunnersProcedure is the fully-qualified name of the RunService's ListRunners RPC.	61		// RunServiceListRunnersProcedure is the fully-qualified name of the RunService's ListRunners RPC.

@@ -127,6 +130,21 @@ type RunServiceClient interface {
127	// with failed_precondition if the latest attempt has not completed, or if	130		// with failed_precondition if the latest attempt has not completed, or if
128	// failed_only is set and no job failed. The new attempt is returned QUEUED.	131		// failed_only is set and no job failed. The new attempt is returned QUEUED.
129	RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)	132		RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)
		133	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
		134	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
		135	+	// scope on the repository. The workflow is read at ref and must have
		136	+	// "workflow_dispatch" among its events. The run has event
		137	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
		138	+	// actor; it is trusted when the caller is the owner and not trusted when the
		139	+	// caller is a token limited to branches. The run is returned QUEUED, before
		140	+	// any job has been given to a runner. Only servers with the feature
		141	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
		142	+	// not_found if the repository, the workflow file or ref does not exist,
		143	+	// with failed_precondition if the workflow does not declare
		144	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
		145	+	// missing while required without default, or has a value of the wrong type
		146	+	// or outside its choices, or if the workflow file is not valid.
		147	+	DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error)
130	// ListChecks lists the checks of a commit: for each job of each run on that	148		// ListChecks lists the checks of a commit: for each job of each run on that
131	// sha, the one of the latest attempt, ordered by creation time then name.	149		// sha, the one of the latest attempt, ordered by creation time then name.
132	// A commit without a run has no check: the list is empty, which is not an	150		// A commit without a run has no check: the list is empty, which is not an

@@ -203,6 +221,12 @@ func NewRunServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...
203	connect.WithSchema(runServiceMethods.ByName("RerunRun")),	221		connect.WithSchema(runServiceMethods.ByName("RerunRun")),
204	connect.WithClientOptions(opts...),	222		connect.WithClientOptions(opts...),
205	),	223		),
		224	+	dispatchWorkflow: connect.NewClient[ermite.DispatchWorkflowRequest, ermite.DispatchWorkflowResponse](
		225	+	httpClient,
		226	+	baseURL+RunServiceDispatchWorkflowProcedure,
		227	+	connect.WithSchema(runServiceMethods.ByName("DispatchWorkflow")),
		228	+	connect.WithClientOptions(opts...),
		229	+	),
206	listChecks: connect.NewClient[ermite.ListChecksRequest, ermite.ListChecksResponse](	230		listChecks: connect.NewClient[ermite.ListChecksRequest, ermite.ListChecksResponse](
207	httpClient,	231		httpClient,
208	baseURL+RunServiceListChecksProcedure,	232		baseURL+RunServiceListChecksProcedure,

@@ -234,6 +258,7 @@ type runServiceClient struct {
234	getJobLog *connect.Client[ermite.GetJobLogRequest, ermite.GetJobLogResponse]	258		getJobLog *connect.Client[ermite.GetJobLogRequest, ermite.GetJobLogResponse]
235	cancelRun *connect.Client[ermite.CancelRunRequest, ermite.CancelRunResponse]	259		cancelRun *connect.Client[ermite.CancelRunRequest, ermite.CancelRunResponse]
236	rerunRun *connect.Client[ermite.RerunRunRequest, ermite.RerunRunResponse]	260		rerunRun *connect.Client[ermite.RerunRunRequest, ermite.RerunRunResponse]
		261	+	dispatchWorkflow *connect.Client[ermite.DispatchWorkflowRequest, ermite.DispatchWorkflowResponse]
237	listChecks *connect.Client[ermite.ListChecksRequest, ermite.ListChecksResponse]	262		listChecks *connect.Client[ermite.ListChecksRequest, ermite.ListChecksResponse]
238	listRunners *connect.Client[ermite.ListRunnersRequest, ermite.ListRunnersResponse]	263		listRunners *connect.Client[ermite.ListRunnersRequest, ermite.ListRunnersResponse]
239	removeRunner *connect.Client[ermite.RemoveRunnerRequest, ermite.RemoveRunnerResponse]	264		removeRunner *connect.Client[ermite.RemoveRunnerRequest, ermite.RemoveRunnerResponse]

@@ -279,6 +304,11 @@ func (c runServiceClient) RerunRun(ctx context.Context, req connect.Request[er
279	return c.rerunRun.CallUnary(ctx, req)	304		return c.rerunRun.CallUnary(ctx, req)
280	}	305		}
281		306
		307	+	// DispatchWorkflow calls ermite.RunService.DispatchWorkflow.
		308	+	func (c runServiceClient) DispatchWorkflow(ctx context.Context, req connect.Request[ermite.DispatchWorkflowRequest]) (*connect.Response[ermite.DispatchWorkflowResponse], error) {
		309	+	return c.dispatchWorkflow.CallUnary(ctx, req)
		310	+	}
		311	+
282	// ListChecks calls ermite.RunService.ListChecks.	312		// ListChecks calls ermite.RunService.ListChecks.
283	func (c runServiceClient) ListChecks(ctx context.Context, req connect.Request[ermite.ListChecksRequest]) (*connect.Response[ermite.ListChecksResponse], error) {	313		func (c runServiceClient) ListChecks(ctx context.Context, req connect.Request[ermite.ListChecksRequest]) (*connect.Response[ermite.ListChecksResponse], error) {
284	return c.listChecks.CallUnary(ctx, req)	314		return c.listChecks.CallUnary(ctx, req)

@@ -360,6 +390,21 @@ type RunServiceHandler interface {
360	// with failed_precondition if the latest attempt has not completed, or if	390		// with failed_precondition if the latest attempt has not completed, or if
361	// failed_only is set and no job failed. The new attempt is returned QUEUED.	391		// failed_only is set and no job failed. The new attempt is returned QUEUED.
362	RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)	392		RerunRun(context.Context, connect.Request[ermite.RerunRunRequest]) (connect.Response[ermite.RerunRunResponse], error)
		393	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
		394	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
		395	+	// scope on the repository. The workflow is read at ref and must have
		396	+	// "workflow_dispatch" among its events. The run has event
		397	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
		398	+	// actor; it is trusted when the caller is the owner and not trusted when the
		399	+	// caller is a token limited to branches. The run is returned QUEUED, before
		400	+	// any job has been given to a runner. Only servers with the feature
		401	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
		402	+	// not_found if the repository, the workflow file or ref does not exist,
		403	+	// with failed_precondition if the workflow does not declare
		404	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
		405	+	// missing while required without default, or has a value of the wrong type
		406	+	// or outside its choices, or if the workflow file is not valid.
		407	+	DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error)
363	// ListChecks lists the checks of a commit: for each job of each run on that	408		// ListChecks lists the checks of a commit: for each job of each run on that
364	// sha, the one of the latest attempt, ordered by creation time then name.	409		// sha, the one of the latest attempt, ordered by creation time then name.
365	// A commit without a run has no check: the list is empty, which is not an	410		// A commit without a run has no check: the list is empty, which is not an

@@ -432,6 +477,12 @@ func NewRunServiceHandler(svc RunServiceHandler, opts ...connect.HandlerOption)
432	connect.WithSchema(runServiceMethods.ByName("RerunRun")),	477		connect.WithSchema(runServiceMethods.ByName("RerunRun")),
433	connect.WithHandlerOptions(opts...),	478		connect.WithHandlerOptions(opts...),
434	)	479		)
		480	+	runServiceDispatchWorkflowHandler := connect.NewUnaryHandler(
		481	+	RunServiceDispatchWorkflowProcedure,
		482	+	svc.DispatchWorkflow,
		483	+	connect.WithSchema(runServiceMethods.ByName("DispatchWorkflow")),
		484	+	connect.WithHandlerOptions(opts...),
		485	+	)
435	runServiceListChecksHandler := connect.NewUnaryHandler(	486		runServiceListChecksHandler := connect.NewUnaryHandler(
436	RunServiceListChecksProcedure,	487		RunServiceListChecksProcedure,
437	svc.ListChecks,	488		svc.ListChecks,

@@ -468,6 +519,8 @@ func NewRunServiceHandler(svc RunServiceHandler, opts ...connect.HandlerOption)
468	runServiceCancelRunHandler.ServeHTTP(w, r)	519		runServiceCancelRunHandler.ServeHTTP(w, r)
469	case RunServiceRerunRunProcedure:	520		case RunServiceRerunRunProcedure:
470	runServiceRerunRunHandler.ServeHTTP(w, r)	521		runServiceRerunRunHandler.ServeHTTP(w, r)
		522	+	case RunServiceDispatchWorkflowProcedure:
		523	+	runServiceDispatchWorkflowHandler.ServeHTTP(w, r)
471	case RunServiceListChecksProcedure:	524		case RunServiceListChecksProcedure:
472	runServiceListChecksHandler.ServeHTTP(w, r)	525		runServiceListChecksHandler.ServeHTTP(w, r)
473	case RunServiceListRunnersProcedure:	526		case RunServiceListRunnersProcedure:

@@ -515,6 +568,10 @@ func (UnimplementedRunServiceHandler) RerunRun(context.Context, *connect.Request
515	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.RerunRun is not implemented"))	568		return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.RerunRun is not implemented"))
516	}	569		}
517		570
		571	+	func (UnimplementedRunServiceHandler) DispatchWorkflow(context.Context, connect.Request[ermite.DispatchWorkflowRequest]) (connect.Response[ermite.DispatchWorkflowResponse], error) {
		572	+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.DispatchWorkflow is not implemented"))
		573	+	}
		574	+
518	func (UnimplementedRunServiceHandler) ListChecks(context.Context, connect.Request[ermite.ListChecksRequest]) (connect.Response[ermite.ListChecksResponse], error) {	575		func (UnimplementedRunServiceHandler) ListChecks(context.Context, connect.Request[ermite.ListChecksRequest]) (connect.Response[ermite.ListChecksResponse], error) {
519	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.ListChecks is not implemented"))	576		return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ermite.RunService.ListChecks is not implemented"))
520	}	577		}

M gen/ermite/run.pb.go +272 -100 generated file: collapsed

load diff

M gen/ermite/runner.pb.go +400 -150 generated file: collapsed

load diff

M gen/ermite/server.pb.go +5 -1 generated file: collapsed

load diff

M gen/ermite/token.pb.go +4 -2 generated file: collapsed

load diff

M gen_test.go +89 -0


@@ -64,9 +64,20 @@ func TestProcedures(t *testing.T) {
64	64		{ermiteconnect.RunServiceGetStepSummariesProcedure, "/ermite.RunService/GetStepSummaries"},
65	65		{ermiteconnect.RunServiceCancelRunProcedure, "/ermite.RunService/CancelRun"},
66	66		{ermiteconnect.RunServiceRerunRunProcedure, "/ermite.RunService/RerunRun"},
	67	+	{ermiteconnect.RunServiceDispatchWorkflowProcedure, "/ermite.RunService/DispatchWorkflow"},
67	68		{ermiteconnect.RunServiceListChecksProcedure, "/ermite.RunService/ListChecks"},
68	69		{ermiteconnect.RunServiceListRunnersProcedure, "/ermite.RunService/ListRunners"},
69	70		{ermiteconnect.RunServiceRemoveRunnerProcedure, "/ermite.RunService/RemoveRunner"},
	71	+	{ermiteconnect.SecretServiceSetSecretProcedure, "/ermite.SecretService/SetSecret"},
	72	+	{ermiteconnect.SecretServiceListSecretsProcedure, "/ermite.SecretService/ListSecrets"},
	73	+	{ermiteconnect.SecretServiceDeleteSecretProcedure, "/ermite.SecretService/DeleteSecret"},
	74	+	{ermiteconnect.VariableServiceSetVariableProcedure, "/ermite.VariableService/SetVariable"},
	75	+	{ermiteconnect.VariableServiceGetVariableProcedure, "/ermite.VariableService/GetVariable"},
	76	+	{ermiteconnect.VariableServiceListVariablesProcedure, "/ermite.VariableService/ListVariables"},
	77	+	{ermiteconnect.VariableServiceDeleteVariableProcedure, "/ermite.VariableService/DeleteVariable"},
	78	+	{ermiteconnect.EnvironmentServiceCreateEnvironmentProcedure, "/ermite.EnvironmentService/CreateEnvironment"},
	79	+	{ermiteconnect.EnvironmentServiceListEnvironmentsProcedure, "/ermite.EnvironmentService/ListEnvironments"},
	80	+	{ermiteconnect.EnvironmentServiceDeleteEnvironmentProcedure, "/ermite.EnvironmentService/DeleteEnvironment"},
70	81		}
71	82		for _, tt := range tests {
72	83		if tt.got != tt.want {

@@ -104,6 +115,7 @@ func TestEnumNumbers(t *testing.T) {
104	115		{"CI_STATUS_QUEUED", int32(ermite.CiStatus_CI_STATUS_QUEUED), 1},
105	116		{"CI_STATUS_IN_PROGRESS", int32(ermite.CiStatus_CI_STATUS_IN_PROGRESS), 2},
106	117		{"CI_STATUS_COMPLETED", int32(ermite.CiStatus_CI_STATUS_COMPLETED), 3},
	118	+	{"CI_STATUS_PENDING", int32(ermite.CiStatus_CI_STATUS_PENDING), 4},
107	119		{"CI_CONCLUSION_UNSPECIFIED", int32(ermite.CiConclusion_CI_CONCLUSION_UNSPECIFIED), 0},
108	120		{"CI_CONCLUSION_SUCCESS", int32(ermite.CiConclusion_CI_CONCLUSION_SUCCESS), 1},
109	121		{"CI_CONCLUSION_FAILURE", int32(ermite.CiConclusion_CI_CONCLUSION_FAILURE), 2},

@@ -450,3 +462,80 @@ func TestCI2RoundTrip(t *testing.T) {
450	462		}
451	463		}
452	464		}
	465	+
	466	+	// TestCI3FieldNumbers pins the numbers of the fields added for CI-3.
	467	+	func TestCI3FieldNumbers(t *testing.T) {
	468	+	tests := []struct {
	469	+	msg proto.Message
	470	+	fields map[string]int
	471	+	}{
	472	+	{&ermite.Job{}, map[string]int{
	473	+	"secrets": 16, "vars": 17, "environment": 18, "permissions": 19, "cache": 20, "trusted": 21,
	474	+	}},
	475	+	{&ermite.JobPermissions{}, map[string]int{"levels": 1}},
	476	+	{&ermite.JobCache{}, map[string]int{"repository": 1, "write_ref": 2, "read_refs": 3}},
	477	+	{&ermite.Run{}, map[string]int{"trusted": 20}},
	478	+	{&ermite.RunJob{}, map[string]int{"concurrency_group": 20}},
	479	+	{&ermite.DispatchWorkflowRequest{}, map[string]int{"repo": 1, "workflow_path": 2, "ref": 3, "inputs": 4}},
	480	+	{&ermite.DispatchWorkflowResponse{}, map[string]int{"run": 1}},
	481	+	{&ermite.SettingsScope{}, map[string]int{"instance": 1, "repo": 2, "environment": 3}},
	482	+	{&ermite.EnvironmentRef{}, map[string]int{"repo": 1, "name": 2}},
	483	+	{&ermite.Secret{}, map[string]int{"name": 1, "updated_at": 2}},
	484	+	{&ermite.Variable{}, map[string]int{"name": 1, "value": 2, "updated_at": 3}},
	485	+	{&ermite.Environment{}, map[string]int{"repo": 1, "name": 2, "created_at": 3}},
	486	+	{&ermite.SetSecretRequest{}, map[string]int{"scope": 1, "name": 2, "value": 3}},
	487	+	{&ermite.ListSecretsRequest{}, map[string]int{"scope": 1, "page_size": 2, "page_token": 3}},
	488	+	{&ermite.ListSecretsResponse{}, map[string]int{"secrets": 1, "next_page_token": 2}},
	489	+	{&ermite.ListVariablesResponse{}, map[string]int{"variables": 1, "next_page_token": 2}},
	490	+	{&ermite.ListEnvironmentsRequest{}, map[string]int{"repo": 1, "page_size": 2, "page_token": 3}},
	491	+	{&ermite.ListEnvironmentsResponse{}, map[string]int{"environments": 1, "next_page_token": 2}},
	492	+	}
	493	+	for _, tt := range tests {
	494	+	md := tt.msg.ProtoReflect().Descriptor()
	495	+	for name, num := range tt.fields {
	496	+	if fd := md.Fields().ByName(protoreflect.Name(name)); fd == nil \|\| int(fd.Number()) != num {
	497	+	t.Errorf("%s.%s: %v, want number %d", md.Name(), name, fd, num)
	498	+	}
	499	+	}
	500	+	}
	501	+	}
	502	+
	503	+	// TestCI3RoundTrip checks that the CI-3 messages survive the wire.
	504	+	func TestCI3RoundTrip(t *testing.T) {
	505	+	msgs := []proto.Message{
	506	+	&ermite.Job{
	507	+	JobId: "j1", Secrets: map[string]string{"TOKEN": "s3cret"}, Vars: map[string]string{"REGION": "eu"},
	508	+	Environment: "staging", Trusted: true,
	509	+	Permissions: &ermite.JobPermissions{Levels: map[string]string{"contents": "write", "packages": "none"}},
	510	+	Cache: &ermite.JobCache{
	511	+	Repository: "ermite", WriteRef: "refs/pull/7/merge",
	512	+	ReadRefs: []string{"refs/pull/7/merge", "refs/heads/main"},
	513	+	},
	514	+	},
	515	+	&ermite.Run{Id: 9, Event: "workflow_dispatch", Trusted: true},
	516	+	&ermite.RunJob{Id: "j1", Status: ermite.CiStatus_CI_STATUS_PENDING, ConcurrencyGroup: "deploy"},
	517	+	&ermite.DispatchWorkflowRequest{Repo: "ermite", WorkflowPath: "ci.yml", Ref: "main", Inputs: map[string]string{"debug": "true"}},
	518	+	&ermite.DispatchWorkflowResponse{Run: &ermite.Run{Id: 9, Event: "workflow_dispatch"}},
	519	+	&ermite.SetSecretRequest{Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Instance{Instance: true}}, Name: "A", Value: "v"},
	520	+	&ermite.SetSecretRequest{Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Repo{Repo: "ermite"}}, Name: "A", Value: "v"},
	521	+	&ermite.SetVariableRequest{
	522	+	Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Environment{Environment: &ermite.EnvironmentRef{Repo: "ermite", Name: "prod"}}},
	523	+	Name: "A", Value: "v",
	524	+	},
	525	+	&ermite.ListSecretsResponse{Secrets: []*ermite.Secret{{Name: "A"}}, NextPageToken: "t"},
	526	+	&ermite.ListEnvironmentsResponse{Environments: []*ermite.Environment{{Repo: "ermite", Name: "prod"}}},
	527	+	}
	528	+	for _, in := range msgs {
	529	+	b, err := proto.Marshal(in)
	530	+	if err != nil {
	531	+	t.Fatal(err)
	532	+	}
	533	+	out := in.ProtoReflect().New().Interface()
	534	+	if err := proto.Unmarshal(b, out); err != nil {
	535	+	t.Fatal(err)
	536	+	}
	537	+	if !proto.Equal(in, out) {
	538	+	t.Errorf("%T: round trip mismatch: %v != %v", in, out, in)
	539	+	}
	540	+	}
	541	+	}


@@ -64,9 +64,20 @@ func TestProcedures(t *testing.T) {
64	{ermiteconnect.RunServiceGetStepSummariesProcedure, "/ermite.RunService/GetStepSummaries"},	64		{ermiteconnect.RunServiceGetStepSummariesProcedure, "/ermite.RunService/GetStepSummaries"},
65	{ermiteconnect.RunServiceCancelRunProcedure, "/ermite.RunService/CancelRun"},	65		{ermiteconnect.RunServiceCancelRunProcedure, "/ermite.RunService/CancelRun"},
66	{ermiteconnect.RunServiceRerunRunProcedure, "/ermite.RunService/RerunRun"},	66		{ermiteconnect.RunServiceRerunRunProcedure, "/ermite.RunService/RerunRun"},
		67	+	{ermiteconnect.RunServiceDispatchWorkflowProcedure, "/ermite.RunService/DispatchWorkflow"},
67	{ermiteconnect.RunServiceListChecksProcedure, "/ermite.RunService/ListChecks"},	68		{ermiteconnect.RunServiceListChecksProcedure, "/ermite.RunService/ListChecks"},
68	{ermiteconnect.RunServiceListRunnersProcedure, "/ermite.RunService/ListRunners"},	69		{ermiteconnect.RunServiceListRunnersProcedure, "/ermite.RunService/ListRunners"},
69	{ermiteconnect.RunServiceRemoveRunnerProcedure, "/ermite.RunService/RemoveRunner"},	70		{ermiteconnect.RunServiceRemoveRunnerProcedure, "/ermite.RunService/RemoveRunner"},
		71	+	{ermiteconnect.SecretServiceSetSecretProcedure, "/ermite.SecretService/SetSecret"},
		72	+	{ermiteconnect.SecretServiceListSecretsProcedure, "/ermite.SecretService/ListSecrets"},
		73	+	{ermiteconnect.SecretServiceDeleteSecretProcedure, "/ermite.SecretService/DeleteSecret"},
		74	+	{ermiteconnect.VariableServiceSetVariableProcedure, "/ermite.VariableService/SetVariable"},
		75	+	{ermiteconnect.VariableServiceGetVariableProcedure, "/ermite.VariableService/GetVariable"},
		76	+	{ermiteconnect.VariableServiceListVariablesProcedure, "/ermite.VariableService/ListVariables"},
		77	+	{ermiteconnect.VariableServiceDeleteVariableProcedure, "/ermite.VariableService/DeleteVariable"},
		78	+	{ermiteconnect.EnvironmentServiceCreateEnvironmentProcedure, "/ermite.EnvironmentService/CreateEnvironment"},
		79	+	{ermiteconnect.EnvironmentServiceListEnvironmentsProcedure, "/ermite.EnvironmentService/ListEnvironments"},
		80	+	{ermiteconnect.EnvironmentServiceDeleteEnvironmentProcedure, "/ermite.EnvironmentService/DeleteEnvironment"},
70	}	81		}
71	for _, tt := range tests {	82		for _, tt := range tests {
72	if tt.got != tt.want {	83		if tt.got != tt.want {

@@ -104,6 +115,7 @@ func TestEnumNumbers(t *testing.T) {
104	{"CI_STATUS_QUEUED", int32(ermite.CiStatus_CI_STATUS_QUEUED), 1},	115		{"CI_STATUS_QUEUED", int32(ermite.CiStatus_CI_STATUS_QUEUED), 1},
105	{"CI_STATUS_IN_PROGRESS", int32(ermite.CiStatus_CI_STATUS_IN_PROGRESS), 2},	116		{"CI_STATUS_IN_PROGRESS", int32(ermite.CiStatus_CI_STATUS_IN_PROGRESS), 2},
106	{"CI_STATUS_COMPLETED", int32(ermite.CiStatus_CI_STATUS_COMPLETED), 3},	117		{"CI_STATUS_COMPLETED", int32(ermite.CiStatus_CI_STATUS_COMPLETED), 3},
		118	+	{"CI_STATUS_PENDING", int32(ermite.CiStatus_CI_STATUS_PENDING), 4},
107	{"CI_CONCLUSION_UNSPECIFIED", int32(ermite.CiConclusion_CI_CONCLUSION_UNSPECIFIED), 0},	119		{"CI_CONCLUSION_UNSPECIFIED", int32(ermite.CiConclusion_CI_CONCLUSION_UNSPECIFIED), 0},
108	{"CI_CONCLUSION_SUCCESS", int32(ermite.CiConclusion_CI_CONCLUSION_SUCCESS), 1},	120		{"CI_CONCLUSION_SUCCESS", int32(ermite.CiConclusion_CI_CONCLUSION_SUCCESS), 1},
109	{"CI_CONCLUSION_FAILURE", int32(ermite.CiConclusion_CI_CONCLUSION_FAILURE), 2},	121		{"CI_CONCLUSION_FAILURE", int32(ermite.CiConclusion_CI_CONCLUSION_FAILURE), 2},

@@ -450,3 +462,80 @@ func TestCI2RoundTrip(t *testing.T) {
450	}	462		}
451	}	463		}
452	}	464		}
		465	+
		466	+	// TestCI3FieldNumbers pins the numbers of the fields added for CI-3.
		467	+	func TestCI3FieldNumbers(t *testing.T) {
		468	+	tests := []struct {
		469	+	msg proto.Message
		470	+	fields map[string]int
		471	+	}{
		472	+	{&ermite.Job{}, map[string]int{
		473	+	"secrets": 16, "vars": 17, "environment": 18, "permissions": 19, "cache": 20, "trusted": 21,
		474	+	}},
		475	+	{&ermite.JobPermissions{}, map[string]int{"levels": 1}},
		476	+	{&ermite.JobCache{}, map[string]int{"repository": 1, "write_ref": 2, "read_refs": 3}},
		477	+	{&ermite.Run{}, map[string]int{"trusted": 20}},
		478	+	{&ermite.RunJob{}, map[string]int{"concurrency_group": 20}},
		479	+	{&ermite.DispatchWorkflowRequest{}, map[string]int{"repo": 1, "workflow_path": 2, "ref": 3, "inputs": 4}},
		480	+	{&ermite.DispatchWorkflowResponse{}, map[string]int{"run": 1}},
		481	+	{&ermite.SettingsScope{}, map[string]int{"instance": 1, "repo": 2, "environment": 3}},
		482	+	{&ermite.EnvironmentRef{}, map[string]int{"repo": 1, "name": 2}},
		483	+	{&ermite.Secret{}, map[string]int{"name": 1, "updated_at": 2}},
		484	+	{&ermite.Variable{}, map[string]int{"name": 1, "value": 2, "updated_at": 3}},
		485	+	{&ermite.Environment{}, map[string]int{"repo": 1, "name": 2, "created_at": 3}},
		486	+	{&ermite.SetSecretRequest{}, map[string]int{"scope": 1, "name": 2, "value": 3}},
		487	+	{&ermite.ListSecretsRequest{}, map[string]int{"scope": 1, "page_size": 2, "page_token": 3}},
		488	+	{&ermite.ListSecretsResponse{}, map[string]int{"secrets": 1, "next_page_token": 2}},
		489	+	{&ermite.ListVariablesResponse{}, map[string]int{"variables": 1, "next_page_token": 2}},
		490	+	{&ermite.ListEnvironmentsRequest{}, map[string]int{"repo": 1, "page_size": 2, "page_token": 3}},
		491	+	{&ermite.ListEnvironmentsResponse{}, map[string]int{"environments": 1, "next_page_token": 2}},
		492	+	}
		493	+	for _, tt := range tests {
		494	+	md := tt.msg.ProtoReflect().Descriptor()
		495	+	for name, num := range tt.fields {
		496	+	if fd := md.Fields().ByName(protoreflect.Name(name)); fd == nil \|\| int(fd.Number()) != num {
		497	+	t.Errorf("%s.%s: %v, want number %d", md.Name(), name, fd, num)
		498	+	}
		499	+	}
		500	+	}
		501	+	}
		502	+
		503	+	// TestCI3RoundTrip checks that the CI-3 messages survive the wire.
		504	+	func TestCI3RoundTrip(t *testing.T) {
		505	+	msgs := []proto.Message{
		506	+	&ermite.Job{
		507	+	JobId: "j1", Secrets: map[string]string{"TOKEN": "s3cret"}, Vars: map[string]string{"REGION": "eu"},
		508	+	Environment: "staging", Trusted: true,
		509	+	Permissions: &ermite.JobPermissions{Levels: map[string]string{"contents": "write", "packages": "none"}},
		510	+	Cache: &ermite.JobCache{
		511	+	Repository: "ermite", WriteRef: "refs/pull/7/merge",
		512	+	ReadRefs: []string{"refs/pull/7/merge", "refs/heads/main"},
		513	+	},
		514	+	},
		515	+	&ermite.Run{Id: 9, Event: "workflow_dispatch", Trusted: true},
		516	+	&ermite.RunJob{Id: "j1", Status: ermite.CiStatus_CI_STATUS_PENDING, ConcurrencyGroup: "deploy"},
		517	+	&ermite.DispatchWorkflowRequest{Repo: "ermite", WorkflowPath: "ci.yml", Ref: "main", Inputs: map[string]string{"debug": "true"}},
		518	+	&ermite.DispatchWorkflowResponse{Run: &ermite.Run{Id: 9, Event: "workflow_dispatch"}},
		519	+	&ermite.SetSecretRequest{Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Instance{Instance: true}}, Name: "A", Value: "v"},
		520	+	&ermite.SetSecretRequest{Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Repo{Repo: "ermite"}}, Name: "A", Value: "v"},
		521	+	&ermite.SetVariableRequest{
		522	+	Scope: &ermite.SettingsScope{Where: &ermite.SettingsScope_Environment{Environment: &ermite.EnvironmentRef{Repo: "ermite", Name: "prod"}}},
		523	+	Name: "A", Value: "v",
		524	+	},
		525	+	&ermite.ListSecretsResponse{Secrets: []*ermite.Secret{{Name: "A"}}, NextPageToken: "t"},
		526	+	&ermite.ListEnvironmentsResponse{Environments: []*ermite.Environment{{Repo: "ermite", Name: "prod"}}},
		527	+	}
		528	+	for _, in := range msgs {
		529	+	b, err := proto.Marshal(in)
		530	+	if err != nil {
		531	+	t.Fatal(err)
		532	+	}
		533	+	out := in.ProtoReflect().New().Interface()
		534	+	if err := proto.Unmarshal(b, out); err != nil {
		535	+	t.Fatal(err)
		536	+	}
		537	+	if !proto.Equal(in, out) {
		538	+	t.Errorf("%T: round trip mismatch: %v != %v", in, out, in)
		539	+	}
		540	+	}
		541	+	}

A proto/ermite/ci_settings.proto +297 -0

@@ -0,0 +1,297 @@
	1	+	// SPDX-License-Identifier: MIT
	2	+
	3	+	syntax = "proto3";
	4	+
	5	+	package ermite;
	6	+
	7	+	import "google/protobuf/timestamp.proto";
	8	+
	9	+	// SettingsScope says where a secret or a variable lives, like the scopes of
	10	+	// GitHub Actions. A job sees the ones of its instance, its repository and its
	11	+	// environment, and the narrowest scope wins: environment over repository over
	12	+	// instance.
	13	+	message SettingsScope {
	14	+	// Where is the scope. It is required: a request without it is
	15	+	// invalid_argument.
	16	+	oneof where {
	17	+	// Instance is the whole server. It must be true when set. It needs a token
	18	+	// that is not restricted to repositories, or the root token.
	19	+	bool instance = 1;
	20	+	// Repo is the name of a repository.
	21	+	string repo = 2;
	22	+	// Environment is an environment of a repository.
	23	+	EnvironmentRef environment = 3;
	24	+	}
	25	+	}
	26	+
	27	+	// EnvironmentRef names an environment of a repository.
	28	+	message EnvironmentRef {
	29	+	// Repo is the repository name.
	30	+	string repo = 1;
	31	+	// Name is the environment name, see Environment.name.
	32	+	string name = 2;
	33	+	}
	34	+
	35	+	// Secret describes a stored secret. It never contains the value: a value can
	36	+	// be set but not read back.
	37	+	message Secret {
	38	+	// Name is the name of the secret, in upper case as the server stores it.
	39	+	string name = 1;
	40	+	// UpdatedAt is when the value was last set.
	41	+	google.protobuf.Timestamp updated_at = 2;
	42	+	}
	43	+
	44	+	// Variable is a configuration variable. Unlike a secret its value can be read
	45	+	// back and it may appear in logs.
	46	+	message Variable {
	47	+	// Name is the name of the variable, in upper case as the server stores it.
	48	+	string name = 1;
	49	+	// Value is the value, at most 48 KiB.
	50	+	string value = 2;
	51	+	// UpdatedAt is when the value was last set.
	52	+	google.protobuf.Timestamp updated_at = 3;
	53	+	}
	54	+
	55	+	// Environment is a named deployment target of a repository, to which secrets
	56	+	// and variables can be attached. A workflow job that names an environment
	57	+	// creates it on first use, as on GitHub.
	58	+	message Environment {
	59	+	// Repo is the repository name.
	60	+	string repo = 1;
	61	+	// Name is the name of the environment, 1 to 255 characters without control
	62	+	// characters, unique in the repository without regard to case. The server
	63	+	// keeps the case it was given.
	64	+	string name = 2;
	65	+	// CreatedAt is when the environment was created.
	66	+	google.protobuf.Timestamp created_at = 3;
	67	+	}
	68	+
	69	+	// SecretService manages the encrypted secrets that CI jobs receive, like `gh
	70	+	// secret` does on GitHub. Names are 1 to 255 characters among letters, digits
	71	+	// and "_", do not begin with a digit or with "GITHUB_", and are
	72	+	// case-insensitive: the server stores them in upper case.
	73	+	//
	74	+	// Every RPC needs the secrets:write scope on a token that may access the
	75	+	// repository of the scope (a repository-restricted token cannot use the
	76	+	// instance scope), or the root token. Tokens limited to branches are refused
	77	+	// with permission_denied, whatever their scopes: they never hold the owner's
	78	+	// rights. A repository that does not exist or that the caller cannot access
	79	+	// gives not_found.
	80	+	//
	81	+	// Values are encrypted at rest with the server's key. A server without a key
	82	+	// refuses to set a secret with failed_precondition and sends no secrets to
	83	+	// jobs. The API never returns a value, and the server never logs one.
	84	+	//
	85	+	// Page sizes and page tokens work as in the other services.
	86	+	//
	87	+	// Servers that implement it list "ci.secrets" in GetVersionResponse.features.
	88	+	service SecretService {
	89	+	// SetSecret creates the secret or replaces its value. Fails with
	90	+	// invalid_argument if the name is not valid, if the value is empty or longer
	91	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	92	+	// environment of the scope does not exist, and with failed_precondition if
	93	+	// the server has no encryption key.
	94	+	rpc SetSecret(SetSecretRequest) returns (SetSecretResponse);
	95	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	96	+	// the secrets set in that scope, not the ones the scope inherits. It never
	97	+	// returns values.
	98	+	rpc ListSecrets(ListSecretsRequest) returns (ListSecretsResponse);
	99	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	100	+	rpc DeleteSecret(DeleteSecretRequest) returns (DeleteSecretResponse);
	101	+	}
	102	+
	103	+	// SetSecretRequest names a secret and gives its value.
	104	+	message SetSecretRequest {
	105	+	// Scope is where the secret lives.
	106	+	SettingsScope scope = 1;
	107	+	// Name is the name of the secret.
	108	+	string name = 2;
	109	+	// Value is the value in plain text, 1 byte to 48 KiB. It may contain
	110	+	// several lines.
	111	+	string value = 3;
	112	+	}
	113	+
	114	+	// SetSecretResponse describes the stored secret.
	115	+	message SetSecretResponse {
	116	+	// Secret is the secret, without its value.
	117	+	Secret secret = 1;
	118	+	}
	119	+
	120	+	// ListSecretsRequest selects a page of the secrets of a scope.
	121	+	message ListSecretsRequest {
	122	+	// Scope is the scope to list.
	123	+	SettingsScope scope = 1;
	124	+	// PageSize is the maximum number of secrets to return. 0 means the server
	125	+	// default; values above the server maximum are lowered to it.
	126	+	int32 page_size = 2;
	127	+	// PageToken is the next_page_token of a previous response. Empty for the
	128	+	// first page.
	129	+	string page_token = 3;
	130	+	}
	131	+
	132	+	// ListSecretsResponse is one page of secrets.
	133	+	message ListSecretsResponse {
	134	+	// Secrets are the secrets of this page, ordered by name, without values.
	135	+	repeated Secret secrets = 1;
	136	+	// NextPageToken is passed as page_token to get the next page. Empty when
	137	+	// there is no next page.
	138	+	string next_page_token = 2;
	139	+	}
	140	+
	141	+	// DeleteSecretRequest names the secret to delete.
	142	+	message DeleteSecretRequest {
	143	+	// Scope is where the secret lives.
	144	+	SettingsScope scope = 1;
	145	+	// Name is the name of the secret, without regard to case.
	146	+	string name = 2;
	147	+	}
	148	+
	149	+	// DeleteSecretResponse is empty.
	150	+	message DeleteSecretResponse {}
	151	+
	152	+	// VariableService manages the configuration variables that CI jobs receive in
	153	+	// the "vars" context, like `gh variable` does on GitHub. Names follow the
	154	+	// rules of SecretService. Access rules, errors and page handling are those of
	155	+	// SecretService, and the same servers (feature "ci.secrets") implement it.
	156	+	service VariableService {
	157	+	// SetVariable creates the variable or replaces its value. Fails with
	158	+	// invalid_argument if the name is not valid, if the value is longer than 48
	159	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	160	+	// environment of the scope does not exist. An empty value is allowed.
	161	+	rpc SetVariable(SetVariableRequest) returns (SetVariableResponse);
	162	+	// GetVariable returns one variable of one scope, with its value. Fails with
	163	+	// not_found if it does not exist in that scope.
	164	+	rpc GetVariable(GetVariableRequest) returns (GetVariableResponse);
	165	+	// ListVariables lists the variables of one scope, ordered by name, with
	166	+	// their values. It lists only the variables set in that scope.
	167	+	rpc ListVariables(ListVariablesRequest) returns (ListVariablesResponse);
	168	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	169	+	// exist.
	170	+	rpc DeleteVariable(DeleteVariableRequest) returns (DeleteVariableResponse);
	171	+	}
	172	+
	173	+	// SetVariableRequest names a variable and gives its value.
	174	+	message SetVariableRequest {
	175	+	// Scope is where the variable lives.
	176	+	SettingsScope scope = 1;
	177	+	// Name is the name of the variable.
	178	+	string name = 2;
	179	+	// Value is the value, at most 48 KiB.
	180	+	string value = 3;
	181	+	}
	182	+
	183	+	// SetVariableResponse holds the stored variable.
	184	+	message SetVariableResponse {
	185	+	// Variable is the variable as stored.
	186	+	Variable variable = 1;
	187	+	}
	188	+
	189	+	// GetVariableRequest names a variable.
	190	+	message GetVariableRequest {
	191	+	// Scope is where the variable lives.
	192	+	SettingsScope scope = 1;
	193	+	// Name is the name of the variable, without regard to case.
	194	+	string name = 2;
	195	+	}
	196	+
	197	+	// GetVariableResponse holds a variable.
	198	+	message GetVariableResponse {
	199	+	// Variable is the variable.
	200	+	Variable variable = 1;
	201	+	}
	202	+
	203	+	// ListVariablesRequest selects a page of the variables of a scope.
	204	+	message ListVariablesRequest {
	205	+	// Scope is the scope to list.
	206	+	SettingsScope scope = 1;
	207	+	// PageSize is the maximum number of variables to return. 0 means the server
	208	+	// default; values above the server maximum are lowered to it.
	209	+	int32 page_size = 2;
	210	+	// PageToken is the next_page_token of a previous response. Empty for the
	211	+	// first page.
	212	+	string page_token = 3;
	213	+	}
	214	+
	215	+	// ListVariablesResponse is one page of variables.
	216	+	message ListVariablesResponse {
	217	+	// Variables are the variables of this page, ordered by name.
	218	+	repeated Variable variables = 1;
	219	+	// NextPageToken is passed as page_token to get the next page. Empty when
	220	+	// there is no next page.
	221	+	string next_page_token = 2;
	222	+	}
	223	+
	224	+	// DeleteVariableRequest names the variable to delete.
	225	+	message DeleteVariableRequest {
	226	+	// Scope is where the variable lives.
	227	+	SettingsScope scope = 1;
	228	+	// Name is the name of the variable, without regard to case.
	229	+	string name = 2;
	230	+	}
	231	+
	232	+	// DeleteVariableResponse is empty.
	233	+	message DeleteVariableResponse {}
	234	+
	235	+	// EnvironmentService manages the environments of a repository, to which
	236	+	// secrets and variables are attached. Environments have no protection rules
	237	+	// and no deployments. Access rules and errors are those of SecretService (the
	238	+	// secrets:write scope, no token limited to branches), and the same servers
	239	+	// (feature "ci.secrets") implement it.
	240	+	service EnvironmentService {
	241	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	242	+	// if the environment already exists (without regard to case), as GitHub's
	243	+	// create-or-update does. Fails with invalid_argument if the name is not
	244	+	// valid and with not_found if the repository does not exist.
	245	+	rpc CreateEnvironment(CreateEnvironmentRequest) returns (CreateEnvironmentResponse);
	246	+	// ListEnvironments lists the environments of a repository, ordered by name.
	247	+	rpc ListEnvironments(ListEnvironmentsRequest) returns (ListEnvironmentsResponse);
	248	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	249	+	// Fails with not_found if it does not exist.
	250	+	rpc DeleteEnvironment(DeleteEnvironmentRequest) returns (DeleteEnvironmentResponse);
	251	+	}
	252	+
	253	+	// CreateEnvironmentRequest names the environment to create.
	254	+	message CreateEnvironmentRequest {
	255	+	// Repo is the repository name.
	256	+	string repo = 1;
	257	+	// Name is the name of the environment, see Environment.name.
	258	+	string name = 2;
	259	+	}
	260	+
	261	+	// CreateEnvironmentResponse holds the environment.
	262	+	message CreateEnvironmentResponse {
	263	+	// Environment is the environment, new or existing.
	264	+	Environment environment = 1;
	265	+	}
	266	+
	267	+	// ListEnvironmentsRequest selects a page of the environments of a repository.
	268	+	message ListEnvironmentsRequest {
	269	+	// Repo is the repository name.
	270	+	string repo = 1;
	271	+	// PageSize is the maximum number of environments to return. 0 means the
	272	+	// server default; values above the server maximum are lowered to it.
	273	+	int32 page_size = 2;
	274	+	// PageToken is the next_page_token of a previous response. Empty for the
	275	+	// first page.
	276	+	string page_token = 3;
	277	+	}
	278	+
	279	+	// ListEnvironmentsResponse is one page of environments.
	280	+	message ListEnvironmentsResponse {
	281	+	// Environments are the environments of this page, ordered by name.
	282	+	repeated Environment environments = 1;
	283	+	// NextPageToken is passed as page_token to get the next page. Empty when
	284	+	// there is no next page.
	285	+	string next_page_token = 2;
	286	+	}
	287	+
	288	+	// DeleteEnvironmentRequest names the environment to delete.
	289	+	message DeleteEnvironmentRequest {
	290	+	// Repo is the repository name.
	291	+	string repo = 1;
	292	+	// Name is the name of the environment, without regard to case.
	293	+	string name = 2;
	294	+	}
	295	+
	296	+	// DeleteEnvironmentResponse is empty.
	297	+	message DeleteEnvironmentResponse {}

@@ -0,0 +1,297 @@
	1	+	// SPDX-License-Identifier: MIT
	2	+
	3	+	syntax = "proto3";
	4	+
	5	+	package ermite;
	6	+
	7	+	import "google/protobuf/timestamp.proto";
	8	+
	9	+	// SettingsScope says where a secret or a variable lives, like the scopes of
	10	+	// GitHub Actions. A job sees the ones of its instance, its repository and its
	11	+	// environment, and the narrowest scope wins: environment over repository over
	12	+	// instance.
	13	+	message SettingsScope {
	14	+	// Where is the scope. It is required: a request without it is
	15	+	// invalid_argument.
	16	+	oneof where {
	17	+	// Instance is the whole server. It must be true when set. It needs a token
	18	+	// that is not restricted to repositories, or the root token.
	19	+	bool instance = 1;
	20	+	// Repo is the name of a repository.
	21	+	string repo = 2;
	22	+	// Environment is an environment of a repository.
	23	+	EnvironmentRef environment = 3;
	24	+	}
	25	+	}
	26	+
	27	+	// EnvironmentRef names an environment of a repository.
	28	+	message EnvironmentRef {
	29	+	// Repo is the repository name.
	30	+	string repo = 1;
	31	+	// Name is the environment name, see Environment.name.
	32	+	string name = 2;
	33	+	}
	34	+
	35	+	// Secret describes a stored secret. It never contains the value: a value can
	36	+	// be set but not read back.
	37	+	message Secret {
	38	+	// Name is the name of the secret, in upper case as the server stores it.
	39	+	string name = 1;
	40	+	// UpdatedAt is when the value was last set.
	41	+	google.protobuf.Timestamp updated_at = 2;
	42	+	}
	43	+
	44	+	// Variable is a configuration variable. Unlike a secret its value can be read
	45	+	// back and it may appear in logs.
	46	+	message Variable {
	47	+	// Name is the name of the variable, in upper case as the server stores it.
	48	+	string name = 1;
	49	+	// Value is the value, at most 48 KiB.
	50	+	string value = 2;
	51	+	// UpdatedAt is when the value was last set.
	52	+	google.protobuf.Timestamp updated_at = 3;
	53	+	}
	54	+
	55	+	// Environment is a named deployment target of a repository, to which secrets
	56	+	// and variables can be attached. A workflow job that names an environment
	57	+	// creates it on first use, as on GitHub.
	58	+	message Environment {
	59	+	// Repo is the repository name.
	60	+	string repo = 1;
	61	+	// Name is the name of the environment, 1 to 255 characters without control
	62	+	// characters, unique in the repository without regard to case. The server
	63	+	// keeps the case it was given.
	64	+	string name = 2;
	65	+	// CreatedAt is when the environment was created.
	66	+	google.protobuf.Timestamp created_at = 3;
	67	+	}
	68	+
	69	+	// SecretService manages the encrypted secrets that CI jobs receive, like `gh
	70	+	// secret` does on GitHub. Names are 1 to 255 characters among letters, digits
	71	+	// and "_", do not begin with a digit or with "GITHUB_", and are
	72	+	// case-insensitive: the server stores them in upper case.
	73	+	//
	74	+	// Every RPC needs the secrets:write scope on a token that may access the
	75	+	// repository of the scope (a repository-restricted token cannot use the
	76	+	// instance scope), or the root token. Tokens limited to branches are refused
	77	+	// with permission_denied, whatever their scopes: they never hold the owner's
	78	+	// rights. A repository that does not exist or that the caller cannot access
	79	+	// gives not_found.
	80	+	//
	81	+	// Values are encrypted at rest with the server's key. A server without a key
	82	+	// refuses to set a secret with failed_precondition and sends no secrets to
	83	+	// jobs. The API never returns a value, and the server never logs one.
	84	+	//
	85	+	// Page sizes and page tokens work as in the other services.
	86	+	//
	87	+	// Servers that implement it list "ci.secrets" in GetVersionResponse.features.
	88	+	service SecretService {
	89	+	// SetSecret creates the secret or replaces its value. Fails with
	90	+	// invalid_argument if the name is not valid, if the value is empty or longer
	91	+	// than 48 KiB (49,152 bytes), or if scope is not set, with not_found if the
	92	+	// environment of the scope does not exist, and with failed_precondition if
	93	+	// the server has no encryption key.
	94	+	rpc SetSecret(SetSecretRequest) returns (SetSecretResponse);
	95	+	// ListSecrets lists the secrets of one scope, ordered by name. It lists only
	96	+	// the secrets set in that scope, not the ones the scope inherits. It never
	97	+	// returns values.
	98	+	rpc ListSecrets(ListSecretsRequest) returns (ListSecretsResponse);
	99	+	// DeleteSecret deletes a secret. Fails with not_found if it does not exist.
	100	+	rpc DeleteSecret(DeleteSecretRequest) returns (DeleteSecretResponse);
	101	+	}
	102	+
	103	+	// SetSecretRequest names a secret and gives its value.
	104	+	message SetSecretRequest {
	105	+	// Scope is where the secret lives.
	106	+	SettingsScope scope = 1;
	107	+	// Name is the name of the secret.
	108	+	string name = 2;
	109	+	// Value is the value in plain text, 1 byte to 48 KiB. It may contain
	110	+	// several lines.
	111	+	string value = 3;
	112	+	}
	113	+
	114	+	// SetSecretResponse describes the stored secret.
	115	+	message SetSecretResponse {
	116	+	// Secret is the secret, without its value.
	117	+	Secret secret = 1;
	118	+	}
	119	+
	120	+	// ListSecretsRequest selects a page of the secrets of a scope.
	121	+	message ListSecretsRequest {
	122	+	// Scope is the scope to list.
	123	+	SettingsScope scope = 1;
	124	+	// PageSize is the maximum number of secrets to return. 0 means the server
	125	+	// default; values above the server maximum are lowered to it.
	126	+	int32 page_size = 2;
	127	+	// PageToken is the next_page_token of a previous response. Empty for the
	128	+	// first page.
	129	+	string page_token = 3;
	130	+	}
	131	+
	132	+	// ListSecretsResponse is one page of secrets.
	133	+	message ListSecretsResponse {
	134	+	// Secrets are the secrets of this page, ordered by name, without values.
	135	+	repeated Secret secrets = 1;
	136	+	// NextPageToken is passed as page_token to get the next page. Empty when
	137	+	// there is no next page.
	138	+	string next_page_token = 2;
	139	+	}
	140	+
	141	+	// DeleteSecretRequest names the secret to delete.
	142	+	message DeleteSecretRequest {
	143	+	// Scope is where the secret lives.
	144	+	SettingsScope scope = 1;
	145	+	// Name is the name of the secret, without regard to case.
	146	+	string name = 2;
	147	+	}
	148	+
	149	+	// DeleteSecretResponse is empty.
	150	+	message DeleteSecretResponse {}
	151	+
	152	+	// VariableService manages the configuration variables that CI jobs receive in
	153	+	// the "vars" context, like `gh variable` does on GitHub. Names follow the
	154	+	// rules of SecretService. Access rules, errors and page handling are those of
	155	+	// SecretService, and the same servers (feature "ci.secrets") implement it.
	156	+	service VariableService {
	157	+	// SetVariable creates the variable or replaces its value. Fails with
	158	+	// invalid_argument if the name is not valid, if the value is longer than 48
	159	+	// KiB (49,152 bytes) or if scope is not set, and with not_found if the
	160	+	// environment of the scope does not exist. An empty value is allowed.
	161	+	rpc SetVariable(SetVariableRequest) returns (SetVariableResponse);
	162	+	// GetVariable returns one variable of one scope, with its value. Fails with
	163	+	// not_found if it does not exist in that scope.
	164	+	rpc GetVariable(GetVariableRequest) returns (GetVariableResponse);
	165	+	// ListVariables lists the variables of one scope, ordered by name, with
	166	+	// their values. It lists only the variables set in that scope.
	167	+	rpc ListVariables(ListVariablesRequest) returns (ListVariablesResponse);
	168	+	// DeleteVariable deletes a variable. Fails with not_found if it does not
	169	+	// exist.
	170	+	rpc DeleteVariable(DeleteVariableRequest) returns (DeleteVariableResponse);
	171	+	}
	172	+
	173	+	// SetVariableRequest names a variable and gives its value.
	174	+	message SetVariableRequest {
	175	+	// Scope is where the variable lives.
	176	+	SettingsScope scope = 1;
	177	+	// Name is the name of the variable.
	178	+	string name = 2;
	179	+	// Value is the value, at most 48 KiB.
	180	+	string value = 3;
	181	+	}
	182	+
	183	+	// SetVariableResponse holds the stored variable.
	184	+	message SetVariableResponse {
	185	+	// Variable is the variable as stored.
	186	+	Variable variable = 1;
	187	+	}
	188	+
	189	+	// GetVariableRequest names a variable.
	190	+	message GetVariableRequest {
	191	+	// Scope is where the variable lives.
	192	+	SettingsScope scope = 1;
	193	+	// Name is the name of the variable, without regard to case.
	194	+	string name = 2;
	195	+	}
	196	+
	197	+	// GetVariableResponse holds a variable.
	198	+	message GetVariableResponse {
	199	+	// Variable is the variable.
	200	+	Variable variable = 1;
	201	+	}
	202	+
	203	+	// ListVariablesRequest selects a page of the variables of a scope.
	204	+	message ListVariablesRequest {
	205	+	// Scope is the scope to list.
	206	+	SettingsScope scope = 1;
	207	+	// PageSize is the maximum number of variables to return. 0 means the server
	208	+	// default; values above the server maximum are lowered to it.
	209	+	int32 page_size = 2;
	210	+	// PageToken is the next_page_token of a previous response. Empty for the
	211	+	// first page.
	212	+	string page_token = 3;
	213	+	}
	214	+
	215	+	// ListVariablesResponse is one page of variables.
	216	+	message ListVariablesResponse {
	217	+	// Variables are the variables of this page, ordered by name.
	218	+	repeated Variable variables = 1;
	219	+	// NextPageToken is passed as page_token to get the next page. Empty when
	220	+	// there is no next page.
	221	+	string next_page_token = 2;
	222	+	}
	223	+
	224	+	// DeleteVariableRequest names the variable to delete.
	225	+	message DeleteVariableRequest {
	226	+	// Scope is where the variable lives.
	227	+	SettingsScope scope = 1;
	228	+	// Name is the name of the variable, without regard to case.
	229	+	string name = 2;
	230	+	}
	231	+
	232	+	// DeleteVariableResponse is empty.
	233	+	message DeleteVariableResponse {}
	234	+
	235	+	// EnvironmentService manages the environments of a repository, to which
	236	+	// secrets and variables are attached. Environments have no protection rules
	237	+	// and no deployments. Access rules and errors are those of SecretService (the
	238	+	// secrets:write scope, no token limited to branches), and the same servers
	239	+	// (feature "ci.secrets") implement it.
	240	+	service EnvironmentService {
	241	+	// CreateEnvironment creates an environment. It succeeds and changes nothing
	242	+	// if the environment already exists (without regard to case), as GitHub's
	243	+	// create-or-update does. Fails with invalid_argument if the name is not
	244	+	// valid and with not_found if the repository does not exist.
	245	+	rpc CreateEnvironment(CreateEnvironmentRequest) returns (CreateEnvironmentResponse);
	246	+	// ListEnvironments lists the environments of a repository, ordered by name.
	247	+	rpc ListEnvironments(ListEnvironmentsRequest) returns (ListEnvironmentsResponse);
	248	+	// DeleteEnvironment deletes an environment with its secrets and variables.
	249	+	// Fails with not_found if it does not exist.
	250	+	rpc DeleteEnvironment(DeleteEnvironmentRequest) returns (DeleteEnvironmentResponse);
	251	+	}
	252	+
	253	+	// CreateEnvironmentRequest names the environment to create.
	254	+	message CreateEnvironmentRequest {
	255	+	// Repo is the repository name.
	256	+	string repo = 1;
	257	+	// Name is the name of the environment, see Environment.name.
	258	+	string name = 2;
	259	+	}
	260	+
	261	+	// CreateEnvironmentResponse holds the environment.
	262	+	message CreateEnvironmentResponse {
	263	+	// Environment is the environment, new or existing.
	264	+	Environment environment = 1;
	265	+	}
	266	+
	267	+	// ListEnvironmentsRequest selects a page of the environments of a repository.
	268	+	message ListEnvironmentsRequest {
	269	+	// Repo is the repository name.
	270	+	string repo = 1;
	271	+	// PageSize is the maximum number of environments to return. 0 means the
	272	+	// server default; values above the server maximum are lowered to it.
	273	+	int32 page_size = 2;
	274	+	// PageToken is the next_page_token of a previous response. Empty for the
	275	+	// first page.
	276	+	string page_token = 3;
	277	+	}
	278	+
	279	+	// ListEnvironmentsResponse is one page of environments.
	280	+	message ListEnvironmentsResponse {
	281	+	// Environments are the environments of this page, ordered by name.
	282	+	repeated Environment environments = 1;
	283	+	// NextPageToken is passed as page_token to get the next page. Empty when
	284	+	// there is no next page.
	285	+	string next_page_token = 2;
	286	+	}
	287	+
	288	+	// DeleteEnvironmentRequest names the environment to delete.
	289	+	message DeleteEnvironmentRequest {
	290	+	// Repo is the repository name.
	291	+	string repo = 1;
	292	+	// Name is the name of the environment, without regard to case.
	293	+	string name = 2;
	294	+	}
	295	+
	296	+	// DeleteEnvironmentResponse is empty.
	297	+	message DeleteEnvironmentResponse {}

M proto/ermite/run.proto +61 -6


@@ -36,9 +36,10 @@ message Run {
36	36		// the name of the workflow registered for workflow_path (the "name" of that
37	37		// file on the default branch, else workflow_name).
38	38		string title = 7;
39		-	// Event is the event that triggered the run, in GitHub's name: "push" (the
40		-	// only one for now; push to a branch or a tag, and merge of a merge
41		-	// request). New values may be added; clients show the ones they do not
	39	+	// Event is the event that triggered the run, in GitHub's name: "push" (push
	40	+	// to a branch or a tag, and merge of a merge request), and from servers with
	41	+	// the matching trigger "pull_request", "workflow_dispatch", "schedule" and
	42	+	// "workflow_run". New values may be added; clients show the ones they do not
42	43		// know as they are.
43	44		string event = 8;
44	45		// Ref is the full ref name that was pushed, for example "refs/heads/main"

@@ -84,6 +85,14 @@ message Run {
84	85		// the workflow has a "run-name". A run stored before this field existed
85	86		// reads as workflow_name.
86	87		string name = 19;
	88	+	// Trusted is true when the run may use secrets and a job token with write
	89	+	// permissions: its actor is the owner, a "workflow_run" inherits it from the
	90	+	// run that triggered it, and a re-run keeps it only if the original run had
	91	+	// it and the caller of the re-run is the owner. It is false when the actor
	92	+	// is a token limited to branches (see Job.trusted). It never goes from false
	93	+	// to true. False for a run stored before this field existed and from servers
	94	+	// without the feature "ci.secrets".
	95	+	bool trusted = 20;
87	96		}
88	97
89	98		// RunJob is a job of a run as people see it: the state of one job instance

@@ -109,7 +118,7 @@ message RunJob {
109	118		// name of the job's check.
110	119		string name = 6;
111	120		// Status is where the job is. A job waits QUEUED for a runner and for the
112		-	// jobs it needs.
	121	+	// jobs it needs, and PENDING for its concurrency group.
113	122		CiStatus status = 7;
114	123		// Conclusion is how the job ended. Unset until status is COMPLETED.
115	124		CiConclusion conclusion = 8;

@@ -148,6 +157,12 @@ message RunJob {
148	157		// and never goes back. A client that holds two copies of a job keeps the
149	158		// one with the higher version and drops the other, as for Run.version.
150	159		int64 version = 19;
	160	+	// ConcurrencyGroup is the evaluated concurrency group of the job (its
	161	+	// "concurrency:", or the one of its workflow), compared without regard to
	162	+	// case within the repository. Empty when the job has none and from servers
	163	+	// without the feature "ci.concurrency". The job is PENDING while another job
	164	+	// of the group runs or a newer one is waiting.
	165	+	string concurrency_group = 20;
151	166		}
152	167
153	168		// Step is one step of a job, with where its lines are in the job log.

@@ -261,12 +276,15 @@ message Runner {
261	276		// request (other fields must be unchanged).
262	277		//
263	278		// Servers that implement the runs side (every RPC but ListRunners,
264		-	// RemoveRunner, ListAnnotations and GetStepSummaries) list "ci.runs" in
	279	+	// RemoveRunner, ListAnnotations, GetStepSummaries and DispatchWorkflow) list
	280	+	// "ci.runs" in
265	281		// GetVersionResponse.features; those that
266	282		// implement the runners side list "ci.runners", as RunnerService does. A server
267	283		// that honours the filters of ListRunsRequest also lists "ci.runs.filters".
268	284		// ListAnnotations needs "ci.annotations" and GetStepSummaries "ci.summaries",
269		-	// which are also the features of the runner side of each.
	285	+	// which are also the features of the runner side of each. DispatchWorkflow
	286	+	// needs "ci.dispatch". RunJob.concurrency_group and CI_STATUS_PENDING belong
	287	+	// to "ci.concurrency", Run.trusted to "ci.secrets".
270	288		service RunService {
271	289		// ListRuns lists the runs of a repository, highest id (newest) first. Each
272	290		// run is described by its latest attempt. The filters narrow the result; a

@@ -332,6 +350,21 @@ service RunService {
332	350		// with failed_precondition if the latest attempt has not completed, or if
333	351		// failed_only is set and no job failed. The new attempt is returned QUEUED.
334	352		rpc RerunRun(RerunRunRequest) returns (RerunRunResponse);
	353	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
	354	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
	355	+	// scope on the repository. The workflow is read at ref and must have
	356	+	// "workflow_dispatch" among its events. The run has event
	357	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
	358	+	// actor; it is trusted when the caller is the owner and not trusted when the
	359	+	// caller is a token limited to branches. The run is returned QUEUED, before
	360	+	// any job has been given to a runner. Only servers with the feature
	361	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
	362	+	// not_found if the repository, the workflow file or ref does not exist,
	363	+	// with failed_precondition if the workflow does not declare
	364	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
	365	+	// missing while required without default, or has a value of the wrong type
	366	+	// or outside its choices, or if the workflow file is not valid.
	367	+	rpc DispatchWorkflow(DispatchWorkflowRequest) returns (DispatchWorkflowResponse);
335	368		// ListChecks lists the checks of a commit: for each job of each run on that
336	369		// sha, the one of the latest attempt, ordered by creation time then name.
337	370		// A commit without a run has no check: the list is empty, which is not an

@@ -556,6 +589,28 @@ message RerunRunResponse {
556	589		Run run = 1;
557	590		}
558	591
	592	+	// DispatchWorkflowRequest names the workflow to run and its inputs.
	593	+	message DispatchWorkflowRequest {
	594	+	// Repo is the repository name.
	595	+	string repo = 1;
	596	+	// WorkflowPath is the path of the workflow file at ref, for example
	597	+	// ".github/workflows/ci.yml", or its file name ("ci.yml").
	598	+	string workflow_path = 2;
	599	+	// Ref is the branch or tag to run on, by short name ("main") or full name
	600	+	// ("refs/heads/main"). Empty means the default branch of the repository.
	601	+	string ref = 3;
	602	+	// Inputs are the values of the "inputs" of the workflow's
	603	+	// "workflow_dispatch" by name, as strings: a boolean is "true" or "false", a
	604	+	// number its decimal text. An input left out takes its default.
	605	+	map<string, string> inputs = 4;
	606	+	}
	607	+
	608	+	// DispatchWorkflowResponse holds the new run.
	609	+	message DispatchWorkflowResponse {
	610	+	// Run is the new run, QUEUED, attempt 1.
	611	+	Run run = 1;
	612	+	}
	613	+
559	614		// ListChecksRequest names the commit.
560	615		message ListChecksRequest {
561	616		// Repo is the repository name.


@@ -36,9 +36,10 @@ message Run {
36		// the name of the workflow registered for workflow_path (the "name" of that	36		// the name of the workflow registered for workflow_path (the "name" of that
37		// file on the default branch, else workflow_name).	37		// file on the default branch, else workflow_name).
38		string title = 7;	38		string title = 7;
39	-	// Event is the event that triggered the run, in GitHub's name: "push" (the	39	+	// Event is the event that triggered the run, in GitHub's name: "push" (push
40	-	// only one for now; push to a branch or a tag, and merge of a merge	40	+	// to a branch or a tag, and merge of a merge request), and from servers with
41	-	// request). New values may be added; clients show the ones they do not	41	+	// the matching trigger "pull_request", "workflow_dispatch", "schedule" and
			42	+	// "workflow_run". New values may be added; clients show the ones they do not
42		// know as they are.	43		// know as they are.
43		string event = 8;	44		string event = 8;
44		// Ref is the full ref name that was pushed, for example "refs/heads/main"	45		// Ref is the full ref name that was pushed, for example "refs/heads/main"

@@ -84,6 +85,14 @@ message Run {
84		// the workflow has a "run-name". A run stored before this field existed	85		// the workflow has a "run-name". A run stored before this field existed
85		// reads as workflow_name.	86		// reads as workflow_name.
86		string name = 19;	87		string name = 19;
			88	+	// Trusted is true when the run may use secrets and a job token with write
			89	+	// permissions: its actor is the owner, a "workflow_run" inherits it from the
			90	+	// run that triggered it, and a re-run keeps it only if the original run had
			91	+	// it and the caller of the re-run is the owner. It is false when the actor
			92	+	// is a token limited to branches (see Job.trusted). It never goes from false
			93	+	// to true. False for a run stored before this field existed and from servers
			94	+	// without the feature "ci.secrets".
			95	+	bool trusted = 20;
87		}	96		}
88			97
89		// RunJob is a job of a run as people see it: the state of one job instance	98		// RunJob is a job of a run as people see it: the state of one job instance

@@ -109,7 +118,7 @@ message RunJob {
109		// name of the job's check.	118		// name of the job's check.
110		string name = 6;	119		string name = 6;
111		// Status is where the job is. A job waits QUEUED for a runner and for the	120		// Status is where the job is. A job waits QUEUED for a runner and for the
112	-	// jobs it needs.	121	+	// jobs it needs, and PENDING for its concurrency group.
113		CiStatus status = 7;	122		CiStatus status = 7;
114		// Conclusion is how the job ended. Unset until status is COMPLETED.	123		// Conclusion is how the job ended. Unset until status is COMPLETED.
115		CiConclusion conclusion = 8;	124		CiConclusion conclusion = 8;

@@ -148,6 +157,12 @@ message RunJob {
148		// and never goes back. A client that holds two copies of a job keeps the	157		// and never goes back. A client that holds two copies of a job keeps the
149		// one with the higher version and drops the other, as for Run.version.	158		// one with the higher version and drops the other, as for Run.version.
150		int64 version = 19;	159		int64 version = 19;
			160	+	// ConcurrencyGroup is the evaluated concurrency group of the job (its
			161	+	// "concurrency:", or the one of its workflow), compared without regard to
			162	+	// case within the repository. Empty when the job has none and from servers
			163	+	// without the feature "ci.concurrency". The job is PENDING while another job
			164	+	// of the group runs or a newer one is waiting.
			165	+	string concurrency_group = 20;
151		}	166		}
152			167
153		// Step is one step of a job, with where its lines are in the job log.	168		// Step is one step of a job, with where its lines are in the job log.

@@ -261,12 +276,15 @@ message Runner {
261		// request (other fields must be unchanged).	276		// request (other fields must be unchanged).
262		//	277		//
263		// Servers that implement the runs side (every RPC but ListRunners,	278		// Servers that implement the runs side (every RPC but ListRunners,
264	-	// RemoveRunner, ListAnnotations and GetStepSummaries) list "ci.runs" in	279	+	// RemoveRunner, ListAnnotations, GetStepSummaries and DispatchWorkflow) list
			280	+	// "ci.runs" in
265		// GetVersionResponse.features; those that	281		// GetVersionResponse.features; those that
266		// implement the runners side list "ci.runners", as RunnerService does. A server	282		// implement the runners side list "ci.runners", as RunnerService does. A server
267		// that honours the filters of ListRunsRequest also lists "ci.runs.filters".	283		// that honours the filters of ListRunsRequest also lists "ci.runs.filters".
268		// ListAnnotations needs "ci.annotations" and GetStepSummaries "ci.summaries",	284		// ListAnnotations needs "ci.annotations" and GetStepSummaries "ci.summaries",
269	-	// which are also the features of the runner side of each.	285	+	// which are also the features of the runner side of each. DispatchWorkflow
			286	+	// needs "ci.dispatch". RunJob.concurrency_group and CI_STATUS_PENDING belong
			287	+	// to "ci.concurrency", Run.trusted to "ci.secrets".
270		service RunService {	288		service RunService {
271		// ListRuns lists the runs of a repository, highest id (newest) first. Each	289		// ListRuns lists the runs of a repository, highest id (newest) first. Each
272		// run is described by its latest attempt. The filters narrow the result; a	290		// run is described by its latest attempt. The filters narrow the result; a

@@ -332,6 +350,21 @@ service RunService {
332		// with failed_precondition if the latest attempt has not completed, or if	350		// with failed_precondition if the latest attempt has not completed, or if
333		// failed_only is set and no job failed. The new attempt is returned QUEUED.	351		// failed_only is set and no job failed. The new attempt is returned QUEUED.
334		rpc RerunRun(RerunRunRequest) returns (RerunRunResponse);	352		rpc RerunRun(RerunRunRequest) returns (RerunRunResponse);
			353	+	// DispatchWorkflow starts a run of a workflow file by hand, like `gh
			354	+	// workflow run` and GitHub's "workflow_dispatch" event. Needs the ci:write
			355	+	// scope on the repository. The workflow is read at ref and must have
			356	+	// "workflow_dispatch" among its events. The run has event
			357	+	// "workflow_dispatch", ref and the commit ref points to, and the caller as
			358	+	// actor; it is trusted when the caller is the owner and not trusted when the
			359	+	// caller is a token limited to branches. The run is returned QUEUED, before
			360	+	// any job has been given to a runner. Only servers with the feature
			361	+	// "ci.dispatch" implement it (unimplemented otherwise). Fails with
			362	+	// not_found if the repository, the workflow file or ref does not exist,
			363	+	// with failed_precondition if the workflow does not declare
			364	+	// "workflow_dispatch", and with invalid_argument if an input is unknown, is
			365	+	// missing while required without default, or has a value of the wrong type
			366	+	// or outside its choices, or if the workflow file is not valid.
			367	+	rpc DispatchWorkflow(DispatchWorkflowRequest) returns (DispatchWorkflowResponse);
335		// ListChecks lists the checks of a commit: for each job of each run on that	368		// ListChecks lists the checks of a commit: for each job of each run on that
336		// sha, the one of the latest attempt, ordered by creation time then name.	369		// sha, the one of the latest attempt, ordered by creation time then name.
337		// A commit without a run has no check: the list is empty, which is not an	370		// A commit without a run has no check: the list is empty, which is not an

@@ -556,6 +589,28 @@ message RerunRunResponse {
556		Run run = 1;	589		Run run = 1;
557		}	590		}
558			591
			592	+	// DispatchWorkflowRequest names the workflow to run and its inputs.
			593	+	message DispatchWorkflowRequest {
			594	+	// Repo is the repository name.
			595	+	string repo = 1;
			596	+	// WorkflowPath is the path of the workflow file at ref, for example
			597	+	// ".github/workflows/ci.yml", or its file name ("ci.yml").
			598	+	string workflow_path = 2;
			599	+	// Ref is the branch or tag to run on, by short name ("main") or full name
			600	+	// ("refs/heads/main"). Empty means the default branch of the repository.
			601	+	string ref = 3;
			602	+	// Inputs are the values of the "inputs" of the workflow's
			603	+	// "workflow_dispatch" by name, as strings: a boolean is "true" or "false", a
			604	+	// number its decimal text. An input left out takes its default.
			605	+	map<string, string> inputs = 4;
			606	+	}
			607	+
			608	+	// DispatchWorkflowResponse holds the new run.
			609	+	message DispatchWorkflowResponse {
			610	+	// Run is the new run, QUEUED, attempt 1.
			611	+	Run run = 1;
			612	+	}
			613	+
559		// ListChecksRequest names the commit.	614		// ListChecksRequest names the commit.
560		message ListChecksRequest {	615		message ListChecksRequest {
561		// Repo is the repository name.	616		// Repo is the repository name.

M proto/ermite/runner.proto +84 -4


@@ -19,6 +19,11 @@ enum CiStatus {
19	19		CI_STATUS_IN_PROGRESS = 2;
20	20		// Over. The conclusion says how it ended.
21	21		CI_STATUS_COMPLETED = 3;
	22	+	// Held back by a concurrency group: another run or job of the group is
	23	+	// running, or a newer one is waiting (see RunJob.concurrency_group). Only for
	24	+	// jobs and checks, and only from servers with the feature "ci.concurrency";
	25	+	// a client that does not know the value shows it as queued.
	26	+	CI_STATUS_PENDING = 4;
22	27		}
23	28
24	29		// CiConclusion is how a run, a job, a step or a check ended, with GitHub's

@@ -171,7 +176,9 @@ enum ActionSource {
171	176		// Job.github_token also list "ci.actions", those that accept annotations
172	177		// (UpdateJobRequest.annotations, CompleteJobRequest.annotations) list
173	178		// "ci.annotations", and those that implement UploadSummary list
174		-	// "ci.summaries". A server without a feature ignores the fields of that
	179	+	// "ci.summaries". Those that send Job.secrets, Job.vars, Job.environment,
	180	+	// Job.permissions and Job.trusted list "ci.secrets", and those that send
	181	+	// Job.cache list "ci.cache". A server without a feature ignores the fields of that
175	182		// feature (protobuf drops unknown fields) and answers unimplemented to its
176	183		// RPCs; a runner that needs one checks GetVersion first.
177	184		service RunnerService {

@@ -534,14 +541,84 @@ message Job {
534	541		// "secrets.GITHUB_TOKEN" of the job: "ermitegh_" and 43 base64url characters
535	542		// (32 random bytes, no padding). Unlike job_token it is meant for the code of
536	543		// the job: the runner gives it to the sandbox (actions/checkout clones with
537		-	// it). It can only read the repository of the run (read-only, whatever
538		-	// "permissions:" says), and is valid from the assignment until the job ends
	544	+	// it). It can only act on the repository of the run: read-only from servers
	545	+	// without the feature "ci.secrets", whatever "permissions:" says, and with
	546	+	// the rights of permissions from those that have it (never more than read
	547	+	// when trusted is false). It is valid from the assignment until the job ends
539	548		// (it is revoked then, on cancellation and when the job is lost). It is a
540	549		// secret: the runner registers it in its masker before anything runs, and
541	550		// neither the runner nor the server logs it. It is shown only in this
542	551		// response, or in a repeat of the same poll_id; a new assignment of the same
543	552		// job has a new one. Empty from servers without the feature "ci.actions".
544	553		string github_token = 15;
	554	+	// Secrets are the secrets of the job by name (upper case), in plain text:
	555	+	// the ones the job's workflow refers to, from the instance, the repository
	556	+	// and the environment, with the environment overriding the repository and
	557	+	// the repository the instance. The server picks them; the runner uses them
	558	+	// as they are. They are empty when the job is not trusted, when the job
	559	+	// refers to none, and from servers without the feature "ci.secrets"; the
	560	+	// "GITHUB_TOKEN" secret is github_token, not an entry here. They travel only
	561	+	// over the runner's authenticated channel. The runner never logs them, never
	562	+	// writes them to disk or to its recovery state, and registers them in its
	563	+	// log masker before the first step runs, as GitHub's runner does: each value
	564	+	// trimmed, each non-empty trimmed line of it (split on CR and LF), and the
	565	+	// encoded forms of each. The server never stores them in the run record nor
	566	+	// logs them. Treat the whole map as a secret.
	567	+	map<string, string> secrets = 16;
	568	+	// Vars are the configuration variables of the job by name (upper case),
	569	+	// already merged by the server with environment over repository over
	570	+	// instance. They are not secret. The same values are in the "vars" context
	571	+	// of contexts, which the runner may use instead. Empty from servers without
	572	+	// the feature "ci.secrets".
	573	+	map<string, string> vars = 17;
	574	+	// Environment is the name of the environment the job deploys to (the
	575	+	// evaluated "environment:" of the job). Empty when the job has none. It is
	576	+	// environment that secrets and vars were resolved for.
	577	+	string environment = 18;
	578	+	// Permissions are the effective permissions of github_token. Unset from
	579	+	// servers without the feature "ci.secrets"; the token is then read-only.
	580	+	JobPermissions permissions = 19;
	581	+	// Cache tells the runner which cache entries the job may read and write.
	582	+	// Unset when the server gives the job no cache (the runner then serves no
	583	+	// cache) and from servers without the feature "ci.cache".
	584	+	JobCache cache = 20;
	585	+	// Trusted is true when the run's actor is the owner (or a re-run of a
	586	+	// trusted run by the owner): only then are secrets sent and a write
	587	+	// permission granted. It is false when the actor is a token limited to
	588	+	// branches (an automated agent could otherwise print any secret by pushing a
	589	+	// workflow) and for a re-run of such a run, and then secrets is empty and
	590	+	// github_token is read-only whatever "permissions:" says. The runner states
	591	+	// this in the log of "Set up job". False from servers that do not send it:
	592	+	// the safe reading.
	593	+	bool trusted = 21;
	594	+	}
	595	+
	596	+	// JobPermissions are the permissions of the job repository token, with the
	597	+	// keys and values of the "permissions:" of a GitHub workflow.
	598	+	message JobPermissions {
	599	+	// Levels maps a permission key ("contents", "pull-requests", "id-token",
	600	+	// "actions", ...) to "read", "write" or "none". They are the permissions in
	601	+	// effect after the server merged the workflow's and the job's "permissions:"
	602	+	// (and the caller's, for a reusable workflow) and applied the trust rule of
	603	+	// Job.trusted; a key absent from the map is "none". Keys are lowercase as in
	604	+	// the workflow. The runner prints them in "Set up job" and does not
	605	+	// enforce them: the server checks the token.
	606	+	map<string, string> levels = 1;
	607	+	}
	608	+
	609	+	// JobCache is the scope of the cache of one job. The cache is served by the
	610	+	// runner and shared by the jobs of a repository, as GitHub scopes it.
	611	+	message JobCache {
	612	+	// Repository is the name of the repository whose cache the job uses. Entries
	613	+	// of another repository are never visible to it.
	614	+	string repository = 1;
	615	+	// WriteRef is the only ref the job may save entries under, for example
	616	+	// "refs/heads/main" or "refs/pull/7/merge".
	617	+	string write_ref = 2;
	618	+	// ReadRefs are the refs the job may restore entries from, most specific
	619	+	// first: the ref of the run, then the base branch for a pull request, then
	620	+	// the default branch. Entries under other refs are never restored.
	621	+	repeated string read_refs = 3;
545	622		}
546	623
547	624		// UpdateJobRequest reports the steps of a running job.

@@ -612,7 +689,10 @@ message CompleteJobRequest {
612	689		// are invalid_argument. Each value is at most 1 MiB, and all names and
613	690		// values together at most 1 MiB (1,048,576 bytes); beyond that the whole call
614	691		// is rejected with invalid_argument and the runner reports the failure of
615		-	// the job without outputs, with a line in the log.
	692	+	// the job without outputs, with a line in the log. The runner leaves out an
	693	+	// output whose value its masker would change, with the warning "Skip output
	694	+	// '<name>' since it may contain secret." (as GitHub's runner), so no secret
	695	+	// reaches the server through outputs.
616	696		map<string, string> outputs = 3;
617	697		// RunnerShutdown is true when the runner ends the job because it was told to
618	698		// stop (service stopped, signal). Only allowed with CI_CONCLUSION_CANCELLED.


@@ -19,6 +19,11 @@ enum CiStatus {
19		CI_STATUS_IN_PROGRESS = 2;	19		CI_STATUS_IN_PROGRESS = 2;
20		// Over. The conclusion says how it ended.	20		// Over. The conclusion says how it ended.
21		CI_STATUS_COMPLETED = 3;	21		CI_STATUS_COMPLETED = 3;
			22	+	// Held back by a concurrency group: another run or job of the group is
			23	+	// running, or a newer one is waiting (see RunJob.concurrency_group). Only for
			24	+	// jobs and checks, and only from servers with the feature "ci.concurrency";
			25	+	// a client that does not know the value shows it as queued.
			26	+	CI_STATUS_PENDING = 4;
22		}	27		}
23			28
24		// CiConclusion is how a run, a job, a step or a check ended, with GitHub's	29		// CiConclusion is how a run, a job, a step or a check ended, with GitHub's

@@ -171,7 +176,9 @@ enum ActionSource {
171		// Job.github_token also list "ci.actions", those that accept annotations	176		// Job.github_token also list "ci.actions", those that accept annotations
172		// (UpdateJobRequest.annotations, CompleteJobRequest.annotations) list	177		// (UpdateJobRequest.annotations, CompleteJobRequest.annotations) list
173		// "ci.annotations", and those that implement UploadSummary list	178		// "ci.annotations", and those that implement UploadSummary list
174	-	// "ci.summaries". A server without a feature ignores the fields of that	179	+	// "ci.summaries". Those that send Job.secrets, Job.vars, Job.environment,
			180	+	// Job.permissions and Job.trusted list "ci.secrets", and those that send
			181	+	// Job.cache list "ci.cache". A server without a feature ignores the fields of that
175		// feature (protobuf drops unknown fields) and answers unimplemented to its	182		// feature (protobuf drops unknown fields) and answers unimplemented to its
176		// RPCs; a runner that needs one checks GetVersion first.	183		// RPCs; a runner that needs one checks GetVersion first.
177		service RunnerService {	184		service RunnerService {

@@ -534,14 +541,84 @@ message Job {
534		// "secrets.GITHUB_TOKEN" of the job: "ermitegh_" and 43 base64url characters	541		// "secrets.GITHUB_TOKEN" of the job: "ermitegh_" and 43 base64url characters
535		// (32 random bytes, no padding). Unlike job_token it is meant for the code of	542		// (32 random bytes, no padding). Unlike job_token it is meant for the code of
536		// the job: the runner gives it to the sandbox (actions/checkout clones with	543		// the job: the runner gives it to the sandbox (actions/checkout clones with
537	-	// it). It can only read the repository of the run (read-only, whatever	544	+	// it). It can only act on the repository of the run: read-only from servers
538	-	// "permissions:" says), and is valid from the assignment until the job ends	545	+	// without the feature "ci.secrets", whatever "permissions:" says, and with
			546	+	// the rights of permissions from those that have it (never more than read
			547	+	// when trusted is false). It is valid from the assignment until the job ends
539		// (it is revoked then, on cancellation and when the job is lost). It is a	548		// (it is revoked then, on cancellation and when the job is lost). It is a
540		// secret: the runner registers it in its masker before anything runs, and	549		// secret: the runner registers it in its masker before anything runs, and
541		// neither the runner nor the server logs it. It is shown only in this	550		// neither the runner nor the server logs it. It is shown only in this
542		// response, or in a repeat of the same poll_id; a new assignment of the same	551		// response, or in a repeat of the same poll_id; a new assignment of the same
543		// job has a new one. Empty from servers without the feature "ci.actions".	552		// job has a new one. Empty from servers without the feature "ci.actions".
544		string github_token = 15;	553		string github_token = 15;
			554	+	// Secrets are the secrets of the job by name (upper case), in plain text:
			555	+	// the ones the job's workflow refers to, from the instance, the repository
			556	+	// and the environment, with the environment overriding the repository and
			557	+	// the repository the instance. The server picks them; the runner uses them
			558	+	// as they are. They are empty when the job is not trusted, when the job
			559	+	// refers to none, and from servers without the feature "ci.secrets"; the
			560	+	// "GITHUB_TOKEN" secret is github_token, not an entry here. They travel only
			561	+	// over the runner's authenticated channel. The runner never logs them, never
			562	+	// writes them to disk or to its recovery state, and registers them in its
			563	+	// log masker before the first step runs, as GitHub's runner does: each value
			564	+	// trimmed, each non-empty trimmed line of it (split on CR and LF), and the
			565	+	// encoded forms of each. The server never stores them in the run record nor
			566	+	// logs them. Treat the whole map as a secret.
			567	+	map<string, string> secrets = 16;
			568	+	// Vars are the configuration variables of the job by name (upper case),
			569	+	// already merged by the server with environment over repository over
			570	+	// instance. They are not secret. The same values are in the "vars" context
			571	+	// of contexts, which the runner may use instead. Empty from servers without
			572	+	// the feature "ci.secrets".
			573	+	map<string, string> vars = 17;
			574	+	// Environment is the name of the environment the job deploys to (the
			575	+	// evaluated "environment:" of the job). Empty when the job has none. It is
			576	+	// environment that secrets and vars were resolved for.
			577	+	string environment = 18;
			578	+	// Permissions are the effective permissions of github_token. Unset from
			579	+	// servers without the feature "ci.secrets"; the token is then read-only.
			580	+	JobPermissions permissions = 19;
			581	+	// Cache tells the runner which cache entries the job may read and write.
			582	+	// Unset when the server gives the job no cache (the runner then serves no
			583	+	// cache) and from servers without the feature "ci.cache".
			584	+	JobCache cache = 20;
			585	+	// Trusted is true when the run's actor is the owner (or a re-run of a
			586	+	// trusted run by the owner): only then are secrets sent and a write
			587	+	// permission granted. It is false when the actor is a token limited to
			588	+	// branches (an automated agent could otherwise print any secret by pushing a
			589	+	// workflow) and for a re-run of such a run, and then secrets is empty and
			590	+	// github_token is read-only whatever "permissions:" says. The runner states
			591	+	// this in the log of "Set up job". False from servers that do not send it:
			592	+	// the safe reading.
			593	+	bool trusted = 21;
			594	+	}
			595	+
			596	+	// JobPermissions are the permissions of the job repository token, with the
			597	+	// keys and values of the "permissions:" of a GitHub workflow.
			598	+	message JobPermissions {
			599	+	// Levels maps a permission key ("contents", "pull-requests", "id-token",
			600	+	// "actions", ...) to "read", "write" or "none". They are the permissions in
			601	+	// effect after the server merged the workflow's and the job's "permissions:"
			602	+	// (and the caller's, for a reusable workflow) and applied the trust rule of
			603	+	// Job.trusted; a key absent from the map is "none". Keys are lowercase as in
			604	+	// the workflow. The runner prints them in "Set up job" and does not
			605	+	// enforce them: the server checks the token.
			606	+	map<string, string> levels = 1;
			607	+	}
			608	+
			609	+	// JobCache is the scope of the cache of one job. The cache is served by the
			610	+	// runner and shared by the jobs of a repository, as GitHub scopes it.
			611	+	message JobCache {
			612	+	// Repository is the name of the repository whose cache the job uses. Entries
			613	+	// of another repository are never visible to it.
			614	+	string repository = 1;
			615	+	// WriteRef is the only ref the job may save entries under, for example
			616	+	// "refs/heads/main" or "refs/pull/7/merge".
			617	+	string write_ref = 2;
			618	+	// ReadRefs are the refs the job may restore entries from, most specific
			619	+	// first: the ref of the run, then the base branch for a pull request, then
			620	+	// the default branch. Entries under other refs are never restored.
			621	+	repeated string read_refs = 3;
545		}	622		}
546			623
547		// UpdateJobRequest reports the steps of a running job.	624		// UpdateJobRequest reports the steps of a running job.

@@ -612,7 +689,10 @@ message CompleteJobRequest {
612		// are invalid_argument. Each value is at most 1 MiB, and all names and	689		// are invalid_argument. Each value is at most 1 MiB, and all names and
613		// values together at most 1 MiB (1,048,576 bytes); beyond that the whole call	690		// values together at most 1 MiB (1,048,576 bytes); beyond that the whole call
614		// is rejected with invalid_argument and the runner reports the failure of	691		// is rejected with invalid_argument and the runner reports the failure of
615	-	// the job without outputs, with a line in the log.	692	+	// the job without outputs, with a line in the log. The runner leaves out an
			693	+	// output whose value its masker would change, with the warning "Skip output
			694	+	// '<name>' since it may contain secret." (as GitHub's runner), so no secret
			695	+	// reaches the server through outputs.
616		map<string, string> outputs = 3;	696		map<string, string> outputs = 3;
617		// RunnerShutdown is true when the runner ends the job because it was told to	697		// RunnerShutdown is true when the runner ends the job because it was told to
618		// stop (service stopped, signal). Only allowed with CI_CONCLUSION_CANCELLED.	698		// stop (service stopped, signal). Only allowed with CI_CONCLUSION_CANCELLED.

M proto/ermite/server.proto +5 -1


@@ -39,7 +39,11 @@ message GetVersionResponse {
39	39		// (RunnerService.ResolveActions and Job.github_token), "ci.annotations"
40	40		// (annotations in UpdateJob and CompleteJob, and RunService.ListAnnotations)
41	41		// and "ci.summaries" (RunnerService.UploadSummary and
42		-	// RunService.GetStepSummaries).
	42	+	// RunService.GetStepSummaries). The CI platform identifiers are "ci.secrets"
	43	+	// (SecretService, VariableService and EnvironmentService, and in Job the
	44	+	// secrets, vars, environment, permissions and trusted fields and Run.trusted),
	45	+	// "ci.dispatch" (RunService.DispatchWorkflow), "ci.concurrency"
	46	+	// (CI_STATUS_PENDING and RunJob.concurrency_group) and "ci.cache" (Job.cache).
43	47		repeated string features = 2;
44	48		}
45	49

   // (RunnerService.ResolveActions and Job.github_token), "ci.annotations"
   // (annotations in UpdateJob and CompleteJob, and RunService.ListAnnotations)
   // and "ci.summaries" (RunnerService.UploadSummary and
-  // RunService.GetStepSummaries).
+  // RunService.GetStepSummaries). The CI platform identifiers are "ci.secrets"
+  // (SecretService, VariableService and EnvironmentService, and in Job the
+  // secrets, vars, environment, permissions and trusted fields and Run.trusted),
+  // "ci.dispatch" (RunService.DispatchWorkflow), "ci.concurrency"
+  // (CI_STATUS_PENDING and RunJob.concurrency_group) and "ci.cache" (Job.cache).
   repeated string features = 2;
 }

M proto/ermite/token.proto +4 -2


@@ -28,8 +28,10 @@ enum Scope {
28	28		// SCOPE_CI_WRITE allows re-running or cancelling CI runs. Wire name:
29	29		// ci:write.
30	30		SCOPE_CI_WRITE = 6;
31		-	// SCOPE_SECRETS_WRITE allows setting and deleting secrets and variables.
32		-	// Wire name: secrets:write.
	31	+	// SCOPE_SECRETS_WRITE allows managing secrets, variables and environments
	32	+	// (SecretService, VariableService, EnvironmentService), reads included. A
	33	+	// token limited to branches is refused them even with this scope. Wire name:
	34	+	// secrets:write.
33	35		SCOPE_SECRETS_WRITE = 7;
34	36		// SCOPE_RUNNER_REGISTER allows registering a CI runner. Wire name:
35	37		// runner:register.

   // SCOPE_CI_WRITE allows re-running or cancelling CI runs. Wire name:
   // ci:write.
   SCOPE_CI_WRITE = 6;
-  // SCOPE_SECRETS_WRITE allows setting and deleting secrets and variables.
+  // SCOPE_SECRETS_WRITE allows managing secrets, variables and environments
-  // Wire name: secrets:write.
+  // (SecretService, VariableService, EnvironmentService), reads included. A
+  // token limited to branches is refused them even with this scope. Wire name:
+  // secrets:write.
   SCOPE_SECRETS_WRITE = 7;
   // SCOPE_RUNNER_REGISTER allows registering a CI runner. Wire name:
   // runner:register.