Module secrets 

The bot credentials a setup step consumes, and what the operator’s environment is allowed to carry.

An identifier and a short-lived token are values: the forge CLIs’ own convention carries them in the environment, and rotating one is a command. Key material is not. An App private key downloads exactly once, lives until a browser replaces it, and an environment is a poor vault for it: the block is readable at /proc/<pid>/environ, and every later child of that shell inherits it. So the operator names the key’s path to rk, and rk reads the file and writes the bytes to the step’s standard input. The path goes no further than rk: no child is told it, so no child can open it.

rk reads the file exactly once: to refuse a wrong one before anything is written to the forge, to hold the redaction needle that keeps the journal’s redacted claim honest, and to be the bytes the step sends. One read means the file that was validated is the file that is stored — nothing between the check and the forge can substitute another. That read lands in a Zeroizing buffer, scrubbed on drop, and is never exported, echoed, or recorded.

Structs

KeyFile

A validated private key file.

Constants

LEGACY_PRIVATE_KEY

The variable that once carried the key’s contents. It is refused now, rather than ignored: a stale export is the leak this module exists to end, and silence would let it stand.

PRIVATE_KEY_FILE

The variable naming the App private key file.

VALUE_VARS

The variables whose value the environment may carry: an App identifier, which the App’s settings page shows, and a project access token, which the forge mints and a command rotates.

Functions

refuse_legacy_key

Refuse a stale RK_BOT_PRIVATE_KEY export wherever a run starts, so rk setup, rk setup step, and rk setup check all catch it rather than one step alone.

resolve_key_file

The validated private key file, where the operator named one.

value_of

The environment’s value for name, absent when unset or empty.