Secrets, fork pull requests and egress

Secrets

A pipeline lists the names of the secrets a job needs. The values live in an encrypted vault, never in the pipeline file, the run record, a queue message or a log.

overlane ci secrets
overlane ci secret set NPM_TOKEN --from-env NPM_TOKEN

The value comes from an environment variable or standard input, never from an argument that would land in your shell history. Values shorter than 8 characters are refused because they cannot be masked reliably. Setting or deleting a secret is a safety class that needs an approval from an independent agent (evidence and a reason) or a person, and no call made with your own token returns a value.

When a job starts, the service issues it one credential bound to the run, the job and the secret names the job declared. The runner exchanges it once for the values. A second exchange, another job, an expired credential and another team’s run are all refused the same way.

Logs are masked by the runner, again by the service before storage, and once more when shown: the exact value, its base64 and URL-encoded forms, and anything shaped like a provider key are replaced with ***. A job that declares a secret nobody set fails with the name of the missing secret and does not run.

Fork pull requests

A pull request whose head comes from a fork never receives secrets. The job still runs, with an empty secret environment, and its log says so. The fork flag comes from the pull request’s own record on the server, never from a request, so a caller cannot ask for a fork to be treated as trusted or a trusted run as a fork.

Egress

A job can reach only the hosts its pipeline lists under egress, and only those that guardrail rules allow. Each listed host is checked against the rules as an egress.fetch action; a denied host is dropped from the list and the log names the rule. A job with no hosts has no network. The runner enforces the list with an allowlist proxy.

overlane guard rules list
overlane guard dry-run --tool egress.fetch --host registry.example.com

What runs

CI runners run your repository’s code. They never run a subscription client, and they never hold Overlane’s own model credentials.

Command reference: ci secrets, ci secret set, ci secret delete and guard dry-run.