runner.execution-secret-stage-gcp

Stage runner environment values into GCP Secret Manager and return secretKeyRef references

Stage runner env-var values into GCP Secret Manager and return references.

Input secret_values carries plaintext and is marked sensitive=True, so SensitiveDataMiddleware vaults it and the persisted state_data holds a [VAULT:...] reference instead of the values. This requires ltinteg-workflow-engine >= 1.12.0, which serialises non-string vault values through a tagged JSON envelope; older engines raise AttributeError inside after_start and terminalise the run. The floor is declared in pyproject.toml and guarded by tests/test_runners_gcp_secret_handling_contract.py.

Vaulting is defence in depth, not the primary control. The workflow's real protection is structural: secret_values is never echoed onto its own output contract and never written to execution_metadata — only the resulting Secret Manager references leave this workflow, and those are what the launcher binds as secretKeyRef so the values never enter a job spec.

Output secret_environment carries only Secret Manager ids and is safe to feed straight into runner.execution-launch-cloud-run.

Overview

Property	Value
Workflow type	Linear
Library	App-runners-gcp
Version	1.0

Input Schema

Field	Type	Required	Default	Description
`runner_group_uuid`	uuid	Yes	—	Runner group whose GCP connection/project hosts the staged secrets
`organization_uuid`	uuid	No	—	Organization UUID (validated against runner group)
`runner_execution_uuid`	uuid	No	—	Execution the secrets belong to; scopes secret ids and records them for teardown
`secret_values`	dict	Yes	—	env_var_name -> secret VALUE. Vaulted (engine >=1.12.0): persisted state_data holds a [VAULT:...] reference. Written to Secret Manager; never echoed onto the output contract and never written to execution_metadata
`service_account_email`	string	No	—	Runner service account granted roles/secretmanager.secretAccessor (defaults to the runner group's config.service_account)

Output Schema

Field	Type	Required	Default	Description
`runner_group_uuid`	uuid	No	—	Runner group the secrets were staged for
`organization_uuid`	uuid	No	—	Organization UUID (validated against runner group)
`runner_execution_uuid`	uuid	No	—	Execution the secrets were staged for
`secret_environment`	dict	No	—	env_var_name -> Secret Manager secret id; pass to the launch workflow
`staged_secret_ids`	list	No	—	Ephemeral secret ids minted here; deleted when the execution goes terminal
`service_account_email`	string	No	—	Principal granted roles/secretmanager.secretAccessor on each staged secret
`staged_count`	integer	No	—	Number of env vars staged
`completed_at`	string	No	—	ISO timestamp when staging finalised
`failed_at`	string	No	—	ISO timestamp when staging failed
`failure_reason`	string	No	—	Populated only when the workflow ends in FAILED
`failure_type`	string	No	—	—
`failed_action`	string	No	—	—
`failed_at_state`	string	No	—	—
`failed_step`	string	No	—	—
`failed_layer`	string	No	—	—
`error`	string	No	—	—
`error_type`	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
`initiated`	Yes	No	—	`stage_secrets`	—
`staging_secrets`	No	No	—	`complete`	—
`completed`	No	Yes	Yes	—	—
`failed`	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
`initiated`	`stage_secrets`	`staging_secrets`	—
`staging_secrets`	`complete`	`completed`	—
`*` (any state)	`fail`	`failed`	—

API Usage

bash

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "runner.execution-secret-stage-gcp",
  "initial_data": {
    "runner_group_uuid": "value",
    "secret_values": "value"
  }
}

runner.execution-secret-stage-gcp ​

Overview ​

Input Schema ​

Output Schema ​

States ​

State Diagram ​

Transitions ​

API Usage ​