feat: pass secrets to agent via Manifest

coder · evgeniy-scherbina · Jul 7, 2025 · Jul 8, 2025 · Jul 8, 2025 · Jul 8, 2025
commit 27de2ce76c39160f53e1c1cddc9828d89c76c849
diff --git a/agent/agent.go b/agent/agent.go
@@ -1410,6 +1410,10 @@ func (a *agent) updateCommandEnv(current []string) (updated []string, err error)
 	}
 	envs["PATH"] = fmt.Sprintf("%s%c%s", a.scriptRunner.ScriptBinDir(), filepath.ListSeparator, envs["PATH"])
 
+	for _, secret := range manifest.UserSecrets {
+		envs[secret.EnvName] = secret.Value
+	}
+
 	for k, v := range envs {
 		updated = append(updated, fmt.Sprintf("%s=%s", k, v))
 	}

@@ -99,13 +99,14 @@ message Manifest {
 	repeated WorkspaceAgentMetadata.Description metadata = 12;
 	repeated WorkspaceAgentDevcontainer devcontainers = 17;
 
-  map<string,Secret> user_secrets = 19;
+  repeated Secret user_secrets = 19;
 }
 
 message Secret {
   string name = 1;
   string env_name = 2;
   string file_path = 3;
+  string value = 4;
 }
 
 message WorkspaceAgentDevcontainer {

diff --git a/coderd/agentapi/manifest.go b/coderd/agentapi/manifest.go
@@ -97,6 +97,8 @@ func (a *ManifestAPI) GetManifest(ctx context.Context, _ *agentproto.GetManifest
 		return nil, xerrors.Errorf("fetching workspace agent data: %w", err)
 	}
 
+	_ = userSecrets
+
 	appSlug := appurl.ApplicationURL{
 		AppSlugOrPort: "{{port}}",
 		AgentName:     workspaceAgent.Name,
@@ -153,13 +155,14 @@ func (a *ManifestAPI) GetManifest(ctx context.Context, _ *agentproto.GetManifest
 	}, nil
 }
 
-func dbUserSecretsToProto(userSecrets []database.UserSecret) map[string]*agentproto.Secret {
-	userSecretsProto := make(map[string]*agentproto.Secret)
-	for _, userSecret := range userSecrets {
-		userSecretsProto[userSecret.Name] = &agentproto.Secret{
+func dbUserSecretsToProto(userSecrets []database.UserSecret) []*agentproto.Secret {
+	userSecretsProto := make([]*agentproto.Secret, 0)
+	for i, userSecret := range userSecrets {
+		userSecretsProto[i] = &agentproto.Secret{
 			Name:     userSecret.Name,
 			EnvName:  userSecret.EnvName,
 			FilePath: userSecret.FilePath,
+			Value:    userSecret.Value,
 		}
 	}
 

diff --git a/codersdk/agentsdk/agentsdk.go b/codersdk/agentsdk/agentsdk.go
@@ -114,6 +114,7 @@ type Manifest struct {
 	Metadata                 []codersdk.WorkspaceAgentMetadataDescription `json:"metadata"`
 	Scripts                  []codersdk.WorkspaceAgentScript              `json:"scripts"`
 	Devcontainers            []codersdk.WorkspaceAgentDevcontainer        `json:"devcontainers"`
+	UserSecrets              []codersdk.UserSecretWithValue               `json:"user_secrets"`
 }
 
 type LogSource struct {

diff --git a/codersdk/agentsdk/convert.go b/codersdk/agentsdk/convert.go
@@ -43,6 +43,11 @@ func ManifestFromProto(manifest *proto.Manifest) (Manifest, error) {
 	if err != nil {
 		return Manifest{}, xerrors.Errorf("error converting workspace agent devcontainers: %w", err)
 	}
+	userSecrets, err := SecretsFromProto(manifest.UserSecrets)
+	if err != nil {
+		return Manifest{}, xerrors.Errorf("error converting workspace agent devcontainers: %w", err)
+	}
+
 	return Manifest{
 		ParentID:                 parentID,
 		AgentID:                  agentID,
@@ -62,6 +67,7 @@ func ManifestFromProto(manifest *proto.Manifest) (Manifest, error) {
 		DisableDirectConnections: manifest.DisableDirectConnections,
 		Metadata:                 MetadataDescriptionsFromProto(manifest.Metadata),
 		Devcontainers:            devcontainers,
+		UserSecrets:              userSecrets,
 	}, nil
 }
 
@@ -449,3 +455,24 @@ func ProtoFromDevcontainer(dc codersdk.WorkspaceAgentDevcontainer) *proto.Worksp
 		ConfigPath:      dc.ConfigPath,
 	}
 }
+
+func SecretsFromProto(pss []*proto.Secret) ([]codersdk.UserSecretWithValue, error) {
+	ret := make([]codersdk.UserSecretWithValue, len(pss))
+	for i, ps := range pss {
+		secret, err := SecretFromProto(ps)
+		if err != nil {
+			return nil, xerrors.Errorf("parse secret %v: %w", i, err)
+		}
+		ret[i] = secret
+	}
+	return ret, nil
+}
+
+func SecretFromProto(ps *proto.Secret) (codersdk.UserSecretWithValue, error) {
+	return codersdk.UserSecretWithValue{
+		Name:     ps.Name,
+		EnvName:  ps.EnvName,
+		FilePath: ps.FilePath,
+		Value:    ps.Value,
+	}, nil
+}
diff --git a/codersdk/user_secrets.go b/codersdk/user_secrets.go
@@ -41,6 +41,18 @@ type UserSecret struct {
 	UpdatedAt   time.Time `json:"updated_at" format:"date-time"`
 }
 
+type UserSecretWithValue struct {
+	ID          uuid.UUID `json:"id" format:"uuid"`
+	UserID      uuid.UUID `json:"user_id" format:"uuid"`
+	Name        string    `json:"name"`
+	Description string    `json:"description,omitempty"`
+	EnvName     string    `json:"env_name,omitempty"`
+	FilePath    string    `json:"file_path,omitempty"`
+	Value       string    `json:"value"`
+	CreatedAt   time.Time `json:"created_at" format:"date-time"`
+	UpdatedAt   time.Time `json:"updated_at" format:"date-time"`
+}
+
 type UserSecretValue struct {
 	Value string `json:"value"`
 }

diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts