kimdre/doco-cd v0.130.0

on GitHub

Security: Git credentials are now host-scoped

Previously a global Git access token or GitHub App credential could be sent to any HTTP(S) host selected through a repository URL. Global credentials now require GIT_AUTH_DOMAINS, otherwise doco-cd will not start.

Add every Git host that should receive the global credential:

environment:
  GIT_ACCESS_TOKEN: ${GIT_ACCESS_TOKEN}
  GIT_AUTH_DOMAINS: |
    - domains: [github.com, git.example.com]

This also applies to global GitHub App credentials.

Insecure opt-out

If you deliberately accept the risk of sending global credentials to unmatched hosts, you can set GIT_AUTH_ALLOW_ANY_HOST: "true".

Documentation

• Credential Scope
• Migrating from Global Credentials
• Disabling the Scope

Fetching external secrets in Bulk

If a stack needs many secrets, you do not have to list each one in external_secrets anymore. Set external_secrets_paths to a list of provider paths instead. Doco-CD fetches every secret below each path and makes it available as a variable:

name: myapp
external_secrets_paths:
  - path: 0db45926-c97c-40d4-a3aa-fefd5d5fb492:prod:/myapp/   # Provider specific path, see the provider pages
    prefix: MYAPP_                                           # Optional, added in front of every variable name
    recursive: true                                          # Optional, also fetch secrets in sub folders

More info in the wiki.

What's Changed

🚨 Breaking Changes

• fix(git)!: scope HTTP(S) credentials to GIT_AUTH_DOMAINS hosts by @kimdre in GHSA-ggcr-c46c-q2gj

✨ Features

• feat(secrets): fetch external secrets in bulk by path by @kimdre in #2101

🌟 Improvements

• feat: include resolved revision in per-stack log lines by @acouvreur in #2094

📦 Dependencies

• chore(deps): update docker:29-dind docker digest to 9e79b87 by @renovate[bot] in #2099
• fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #2100
• chore(deps): update dependency zensical to v0.0.72 by @renovate[bot] in #2103
• chore(deps): update gcr.io/distroless/base-debian13 docker digest to f5e9519 by @renovate[bot] in #2105
• fix(deps): update module github.com/getkin/kin-openapi to v0.152.0 by @renovate[bot] in #2104

New Contributors

• @acouvreur made their first contribution in #2094

Full Changelog: v0.129.1...v0.130.0