deploy.service.bind-secrets

Materialize runtime secrets in GCP Secret Manager and grant service-account access.

Overview

Property	Value
Workflow type	Linear
Library	App-deployments
Version	1.0

Input Schema

Field	Type	Required	Default	Description
workflow_run_id	string	No	—	Engine-stamped DAG step run ID.
organization_uuid	uuid	Yes	—	Organization UUID.
connection_uuid	uuid	Yes	—	GCP connection UUID.
project_id	string	No	—	GCP project override.
service_name	string	Yes	—	Logical service name.
service_account	string	Yes	—	Runtime service account email.
secrets	list	Yes	—	Secret requirements; values are sensitive and optional for existing secrets.
labels	json	No	—	Labels applied to generated secrets.

Output Schema

Field	Type	Required	Default	Description
workflow_run_id	string	No	—	Engine-stamped DAG step run ID.
organization_uuid	uuid	No	—	Echoed organization UUID.
connection_uuid	uuid	No	—	Echoed GCP connection UUID.
project_id	string	No	—	Effective project.
service_name	string	No	—	Logical service name.
service_account	string	No	—	Runtime service account.
secret_env	json	No	—	Env var to Secret Manager version references for Cloud Run.
secret_count	integer	No	—	Secrets processed.
rotated_count	integer	No	—	Secret versions created.
granted_count	integer	No	—	Secret IAM grants applied.
failure_reason	string	No	—	Engine failure reason.
failed_step	json	No	—	Failed DAG step envelope.
failed_layer	json	No	—	Failed DAG layer envelope.
failed_at_state	string	No	—	State where failure occurred.
error	string	No	—	Error message.
error_type	string	No	—	Error class.

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	bind	—
binding	No	No	—	complete	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	bind	binding	—
binding	complete	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "deploy.service.bind-secrets",
  "initial_data": {
    "organization_uuid": "value",
    "connection_uuid": "value",
    "service_name": "value",
    "service_account": "value"
  }
}