Secrets

Workflows can reference sensitive values without storing them directly in YAML.

dsn: ${POSTGRES_DSN}
username: ${KAFKA_USERNAME}
password: ${KAFKA_PASSWORD}

The initial resolver reads from the process environment.

export POSTGRES_DSN='postgres://user:pass@localhost:5432/app?sslmode=disable'
export KAFKA_USERNAME='user'
export KAFKA_PASSWORD='pass'

SecretResolver interface

type SecretResolver interface {
    Resolve(name string) (string, error)
}

The compiler can use a custom resolver later. Stored connections are reserved for a future job server.

Redaction rules

Resolved secrets must not appear in:

• Logs.
• Validation output.
• Pipeline descriptions.
• Dashboard metadata.
• Error messages.

Workflow summaries and graph descriptions retain placeholder-safe metadata and omit resolved values.