Secret References and Secrets Files
A secret value is never part of a metadata file. The file holds a named reference, and the value lives in a secrets file or in the credential store on the machine.
The secret reference
A sensitive property, such as the password of a connection, holds an object with a $secret property in place of the value. The $secret property holds a token of the form provider:path.
"password": { "$secret": "store:AWLT-password" }
A literal value in a sensitive property is an error (BFXF007).
Providers
A build resolves two providers.
| Token | Resolves from |
|---|---|
env:<variable> | The environment variable of that name in the process that runs the build. The whole value of the variable is the secret. |
store:<name> | The secrets files of the store first, and the BimlFlex credential store on the machine second. |
Secrets files
The secrets files of a store live in its .bimlflex folder. Every entry in a secrets file is keyed by the full token, such as store:AWLT-password.
| File | Holds |
|---|---|
secrets.env | The default secrets file, with filled values. |
secrets.template.env | A blank template that can be shared. |
secrets.<environment>.env | The values for one environment. A store has one such file per environment. |
Environment names
An environment name is 1 to 64 letters, digits, dashes or underscores. The word template is reserved in any letter case. BimlFlex refuses a name that differs from an existing secrets file only by letter case.
Resolution order
For a store: token, the first of these sources that holds the name answers:
- The secrets file of the environment in effect, when that file exists.
- The default secrets file, when it exists.
- The credential store.
With no environment in effect, the only secrets file read is the default file.
The environment in effect is the environment the BimlFlex App names for the action. When it names none, it is the current environment of the checkout. When neither is set, no environment is in effect.
The secrets environment in the toolbar
In file mode, the toolbar of the BimlFlex App shows the secrets environment. Its menu offers Default, the known environments, and a field for a new environment name.
Revealing and writing a value
The BimlFlex App can reveal one secret value on demand for the environment in effect, and it can write a value to a secrets file. The metadata file keeps the token in both cases.
Secrets during migration
For how secrets are handled when a BimlFlex database moves to files, see Migrate a BimlFlex database to files.
See File Store Diagnostic Codes for every code.