{"id":34991276,"url":"https://github.com/buildkite-plugins/secrets-buildkite-plugin","last_synced_at":"2026-01-22T05:10:24.357Z","repository":{"id":305638854,"uuid":"1003895332","full_name":"buildkite-plugins/secrets-buildkite-plugin","owner":"buildkite-plugins","description":"A Buildkite plugin for retrieving secrets from Buildkite","archived":false,"fork":false,"pushed_at":"2026-01-19T08:41:41.000Z","size":78,"stargazers_count":2,"open_issues_count":1,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-01-19T13:44:03.440Z","etag":null,"topics":["buildkite-plugin","secrets"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/buildkite-plugins.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-06-17T19:58:21.000Z","updated_at":"2026-01-19T05:10:33.000Z","dependencies_parsed_at":"2025-07-21T09:36:40.930Z","dependency_job_id":null,"html_url":"https://github.com/buildkite-plugins/secrets-buildkite-plugin","commit_stats":null,"previous_names":["buildkite-plugins/secrets-buildkite-plugin"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/buildkite-plugins/secrets-buildkite-plugin","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/buildkite-plugins%2Fsecrets-buildkite-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/buildkite-plugins%2Fsecrets-buildkite-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/buildkite-plugins%2Fsecrets-buildkite-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/buildkite-plugins%2Fsecrets-buildkite-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/buildkite-plugins","download_url":"https://codeload.github.com/buildkite-plugins/secrets-buildkite-plugin/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/buildkite-plugins%2Fsecrets-buildkite-plugin/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28655261,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-22T01:17:37.254Z","status":"online","status_checked_at":"2026-01-22T02:00:07.137Z","response_time":144,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["buildkite-plugin","secrets"],"created_at":"2025-12-27T01:54:50.312Z","updated_at":"2026-01-22T05:10:24.352Z","avatar_url":"https://github.com/buildkite-plugins.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Secrets Buildkite Plugin\n\nA Buildkite plugin used to fetch secrets from [Buildkite Secrets](https://buildkite.com/docs/pipelines/security/secrets/buildkite-secrets).\n\n## Changes to consider when upgrading to `v2.0.0`\n\nIf upgrading from v1.x.x, note these changes:\n\n- **Log format**: Uses structured prefixes (`[INFO]`, `[WARNING]`, `[ERROR]`) instead of emoji\n- **Removed**: `dump_env` function removed for security\n- **New default**: Secrets auto-redacted from logs (requires agent v3.67.0+). Opt out with `skip-redaction: true`\n- **Stricter errors**: Invalid base64-encoded secrets now fail immediately\n\n## Storing Secrets\n\nThere are two options for storing and fetching secrets.\n\nYou can create a secret in your Buildkite cluster(s) from the Buildkite UI following the instructions in the documentation [here](https://buildkite.com/docs/pipelines/security/secrets/buildkite-secrets#create-a-secret-using-the-buildkite-interface).\n\n### One at a time\n\nCreate a Buildkite secret for each variable that you need to store. Paste the value of the secret into buildkite.com directly.\n\nA `pipeline.yml` like this will read each secret out into a ENV variable:\n\n```yml\nsteps:\n  - command: echo \"The content of ANIMAL is \\$ANIMAL\"\n    plugins:\n      - secrets#v2.0.0:\n          variables:\n            ANIMAL: llamas\n            FOO: bar\n```\n\n### Multiple\n\nCreate a single Buildkite secret with one variable per line, encoded as base64 for storage.\n\nFor example, setting three variables looks like this in a file:\n\n```shell\nFoo=bar\nSECRET_KEY=llamas\nCOFFEE=more\n```\n\nThen encode the file:\n\n```shell\ncat data.txt | base64\n```\n\nNext, upload the base64 encoded data to buildkite.com in your browser with a\nkey of your choosing - like `llamas`. The three secrets can be read into the\njob environment using a pipeline.yml like this:\n\n```yaml\nsteps:\n  - command: build.sh\n    plugins:\n      - secrets#v2.0.0:\n          env: \"llamas\"\n```\n\n## Options\n\n### `provider` (optional, string, default: `buildkite`)\n\nThe secrets provider to use. Currently only `buildkite` is supported.\n\n### `env` (optional, string)\nThe secret key name to fetch multiple from Buildkite secrets.\n\n### `variables` (optional, object)\nSpecify a dictionary of `key: value` pairs to inject as environment variables, where the key is the name of the\nenvironment variable to be set, and the value is the Buildkite Secret key.\n\n### `skip-redaction` (optional, boolean, default: `false`)\n\nIf set to `true`, secrets will not be automatically redacted from Buildkite logs. By default, all fetched secrets are automatically redacted using the buildkite-agent redactor feature.\nSecret redaction requires buildkite-agent `v3.67.0` or later. If an older agent version is used, a warning will be issued.\n\n### `retry-max-attempts` (optional, number, default: 5)\n\nMaximum number of retry attempts for transient failures when fetching secrets (e.g., 5xx server errors, network issues).\n\n### `retry-base-delay` (optional, number, default: 2)\n\nBase delay in seconds for exponential backoff between retry attempts.\n\n## Secret Redaction\n\nBy default, this plugin automatically redacts all fetched secrets from your Buildkite logs to prevent accidental exposure. This includes:\n\n- The raw secret values\n- Shell-escaped versions of secrets\n- Base64-decoded versions of secrets (if the secret appears to be base64-encoded)\n\nThe redaction feature uses the `buildkite-agent redactor add` command, which requires buildkite-agent `v3.67.0` or later. If you're running an older version, the plugin will log a warning and continue without redaction.\n\nTo disable automatic redaction (not recommended), set `skip-redaction: true`:\n\n```yaml\nsteps:\n  - command: build.sh\n    plugins:\n      - secrets#v2.0.0:\n          env: \"llamas\"\n          skip-redaction: true\n```\n\n## Retry Behavior\n\nThis plugin implements automatic retry logic with exponential backoff for secret calls. This will occur for 5xx server errors or any local network issues. If a 4xx code is received, a fast failure will be served.\n\nBy default, the base delay will be 2 seconds, with a maximum of 5 retries.\n\n### Example with Custom Retry\n\n```yaml\nsteps:\n  - command: build.sh\n    plugins:\n      - secrets#v2.0.0:\n          env: \"llamas\"\n          retry-max-attempts: 10\n          retry-base-delay: 2\n```\n\n## Testing\n\nYou can run the tests using `docker-compose`:\n\n```bash\ndocker compose run --rm tests\n```\n\n## License\n\nMIT (see [LICENSE](LICENSE))\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbuildkite-plugins%2Fsecrets-buildkite-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbuildkite-plugins%2Fsecrets-buildkite-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbuildkite-plugins%2Fsecrets-buildkite-plugin/lists"}