pushci 1.7.5 → 1.8.0

package/README.md

@@ -183,6 +183,59 @@ personas:
       fail:  ["Avast, the build hath sunk."]
 ```
 
+## Secrets
+
+PushCI resolves secret references inline in `pushci.yml` env blocks.
+Three schemes are supported today; PushCI never writes a plaintext
+secret to disk it didn't already encrypt.
+
+| Scheme | Backed by | Best for |
+|---|---|---|
+| `keychain://service[#account]` | macOS Keychain / Windows Credential Manager / Linux Secret Service, with AES-encrypted fallback at `~/.pushci/keychain.enc` for headless CI | Local dev, individual machines |
+| `vault://path#field` | HashiCorp Vault AppRole (`VAULT_ADDR` + `VAULT_ROLE_ID` + `VAULT_SECRET_ID`) | Teams, audited environments |
+| `pushci secrets set KEY VAL` | Per-project AES file at `.pushci/secrets.enc`, machine-bound | Quick one-offs, throwaway scripts |
+
+```yaml
+# pushci.yml
+stages:
+  - name: publish
+    env:
+      NPM_TOKEN: keychain://npm-publish-token
+      DEPLOY_KEY: keychain://deploy-bot#prod
+      DB_PASSWORD: vault://secret/data/prod/db#password
+    checks:
+      - name: publish
+        run: npm publish
+```
+
+**Managing keychain entries from the CLI:**
+
+```bash
+pushci secrets keychain set npm-publish-token npm_xxxxxxxxxxxx
+pushci secrets keychain set deploy-bot#prod  s3cr3t
+pushci secrets keychain get npm-publish-token
+pushci secrets keychain list      # fallback-file entries only
+pushci secrets keychain rm  npm-publish-token
+```
+
+On macOS the storage layout matches the `security` CLI verbatim, so the
+common `.zshrc` helper functions work side-by-side:
+
+```bash
+secret()     { security find-generic-password -a "$USER" -s "$1" -w 2>/dev/null; }
+secret-set() { security add-generic-password    -a "$USER" -s "$1" -w "$2" -U; }
+```
+
+Entries written by `secret-set` are readable by `pushci secrets keychain
+get`, and vice versa — no `go-keyring-base64:` prefix gymnastics.
+
+**Headless Linux CI:** when D-Bus and Secret Service aren't running,
+PushCI falls back transparently to an AES-encrypted file at
+`~/.pushci/keychain.enc` with a machine-bound key. A one-time stderr
+warning fires the first time a fallback read or write happens, so the
+behavior is never silent. Override account default with the `#account`
+suffix; the current OS user is used when omitted.
+
 ## Configuration
 
 `pushci.yml` is optional — `pushci init` generates one that works, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pushci",
-  "version": "1.7.5",
+  "version": "1.8.0",
   "description": "AI-native CI/CD that runs on your machine. Zero config, zero cost. Works inside AI agent sandboxes (Claude, Cursor, Windsurf). 33 languages, 40+ frameworks, 22 deploy targets, 25 installable skills, Tailscale mesh, blast radius analysis.",
   "bin": {
     "pushci": "bin/pushci.js"