@kitsy/cnos-docs 1.8.1 → 1.8.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/guides/ci-cd.mdx +2 -2
- package/docs/guides/secrets.mdx +16 -3
- package/manifest.yml +1 -1
- package/package.json +1 -1
package/docs/guides/ci-cd.mdx
CHANGED
|
@@ -14,10 +14,10 @@ cnos run --profile stage -- pnpm build
|
|
|
14
14
|
cnos build server --profile prod --to dist/.cnos-server.json
|
|
15
15
|
```
|
|
16
16
|
|
|
17
|
-
For
|
|
17
|
+
For environment-backed vaults:
|
|
18
18
|
|
|
19
19
|
```bash
|
|
20
|
-
cnos vault create github-ci --provider
|
|
20
|
+
cnos vault create github-ci --provider environment --no-passphrase
|
|
21
21
|
cnos secret set app.token APP_TOKEN --vault github-ci
|
|
22
22
|
```
|
|
23
23
|
|
package/docs/guides/secrets.mdx
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
title: Secrets and Vaults
|
|
3
|
-
description: Securely manage secrets with local and
|
|
3
|
+
description: Securely manage secrets with local and environment-backed vaults.
|
|
4
4
|
---
|
|
5
5
|
|
|
6
6
|
# Secrets and Vaults
|
|
@@ -15,13 +15,26 @@ cnos secret set app.token super-secret --vault default
|
|
|
15
15
|
|
|
16
16
|
`cnos vault create default` initializes the local encrypted vault immediately. If CNOS cannot resolve a passphrase from env or keychain, it prompts interactively. `cnos vault auth default` is only for re-authenticating an existing vault and rejects wrong passphrases.
|
|
17
17
|
|
|
18
|
-
|
|
18
|
+
Environment-backed vault:
|
|
19
19
|
|
|
20
20
|
```bash
|
|
21
|
-
cnos vault create
|
|
21
|
+
cnos vault create firebase-prod --provider environment --no-passphrase
|
|
22
22
|
cnos secret set app.token APP_TOKEN --vault github-ci
|
|
23
23
|
```
|
|
24
24
|
|
|
25
|
+
`environment` is the generic provider for platforms that inject secrets into environment variables before your process starts. `github-secrets` remains a compatibility alias for the same behavior.
|
|
26
|
+
|
|
27
|
+
This is the CNOS bridge for common cloud and CI runtimes:
|
|
28
|
+
|
|
29
|
+
- GitHub Actions secrets
|
|
30
|
+
- Firebase Functions / Google Secret Manager bindings
|
|
31
|
+
- Cloud Run env-injected secrets
|
|
32
|
+
- Kubernetes Secrets exposed as env vars
|
|
33
|
+
- Vercel project secrets
|
|
34
|
+
- Netlify environment variables
|
|
35
|
+
- AWS Lambda environment variables
|
|
36
|
+
- Azure App Service environment variables
|
|
37
|
+
|
|
25
38
|
By default:
|
|
26
39
|
|
|
27
40
|
- repo files store only refs
|
package/manifest.yml
CHANGED