CLI reference: sparkwing secrets

CLI reference: sparkwing secrets

Every sparkwing secrets command, flag, and argument, generated from the CLI's own command registry. All command groups are indexed in cli-reference.md.

sparkwing secrets

Manage secrets in this machine's local store or on a controller

Subcommands

• delete -- Remove a secret
• get -- Read a secret's value
• list -- List secret names + metadata
• rotate -- Re-encrypt every stored secret under the current key
• set -- Store (or replace) a secret value

Flags

sparkwing secrets delete

Remove a secret

Delete the exact pipeline or unscoped row. A pipeline row is named by --repo and --pipeline together. JSON retains whether the row was deleted or already absent; plain emits the name.

Flags

sparkwing secrets get

Read a secret's value

This explicit authorized read includes the value. --repo and --pipeline together read the row that repository's pipeline would. JSON retains metadata and value, including an empty value. Pretty and plain emit the raw bytes without adding a newline.

Flags

sparkwing secrets list

List secret names + metadata

List metadata without values, including each pipeline row's repository and pipeline, and pool restrictions. Search matches names case-insensitively; --repo matches a repository name case-insensitively or its key exactly, and --pipeline requires --repo. JSON emits metadata records; plain emits names.

Flags

sparkwing secrets rotate

Re-encrypt every stored secret under the current key

Retain rotated counts and skipped row names/pipelines. The previous key is still needed when any row was skipped. JSON includes the controller's replay marker.

Flags

sparkwing secrets set

Store (or replace) a secret value

Restricted --only-on secrets require matching pool demands at seal and reserved pools at release; restricted secrets are refused for here machines.

If neither --value nor --file is supplied, read the value from stdin. Preserve empty values and trailing newlines. --variable stores an unmasked value.

A pipeline secret belongs to one GitHub repository and one pipeline: --repo and --pipeline go together, and only runs whose code Sparkwing fetched from that repository through the team's GitHub App, or whose repository a GitHub Actions job proved, read it; uploaded, local and --runner here runs read only --shared secrets. --repo takes owner/name or a gh: key. --shared stores a team-wide secret every pipeline of every repository in the team reads.

Local unscoped writes are shared with local pipelines. Controller writes preserve explicit --pipeline or --shared selection. Saving a short secret prints one warning line on stderr. Read sparkwing docs read --topic secrets for the masking length rule. JSON returns metadata and replay without the value; plain emits the name.

Flags