| Ticket Hash: | 45f39fc61a51b3a5ac4c18c75ff16f878906c0bf | ||
| Title: | A secret set with OCX's secret tool on the server never reaches a run | ||
| Status: | Open | Type: | Code_Defect |
| Severity: | Severe | Priority: | High |
| Subsystem: | Resolution: | ||
| Last Modified: |
2026-10-31 20:42:02 10.5 days ago |
Created: |
2026-10-31 20:42:02 10.5 days ago |
| Version Found In: | |||
| Description: | ||||
| Found 2026-10-31 in a doc audit. `secret` stores the value on the served repository (src/ocx/commands/secret.cr, 'the server's node fills it in'), but the server has no node any more: a run's secrets are read only from its node's own clone (src/ocx/launch.cr:193, Launch.secrets_of), which sync never fills. So a run naming $$secret:NAME$$ is refused on every node unless the secret was set in that node's clone on its machine. Left for the maintainer to decide whether the secret moves to the node's machine or the node reads it some other way. | ||||