workshopctl (CLI)¶

SDKs use the workshopctl tool when reporting to the workshop; to invoke a subcommand, add it to your SDK hook.

workshopctl get-secret¶

Get the value of a secret connected to the workshop.

Usage

$ workshopctl get-secret [--systemd] <SDK>.<secret>

Description

This command retrieves the value of a secret made available to an SDK through a connected secret plug and writes it to standard output. SDKs typically call it from wrapper scripts to inject secrets into one-shot commands.

Placeholder	Required	Value
`<SDK>.<secret>`	Required unless `--systemd` is given.	The name of the SDK and of its secret plug, joined by a dot.

Examples

Read a secret into an environment variable in a wrapper script:

$ API_KEY=$(workshopctl get-secret my-sdk.api-key)

Flags

--systemd

Service a systemd LoadCredential request. The workshop secret socket unit invokes workshopctl with this flag, passing the accepted socket connection on standard input. The credential name in the requesting unit’s LoadCredential entry must take the form <SDK>.<secret> so that the requesting SDK and secret can be identified from the connection, for example:

LoadCredential=my-sdk.api-key:${SDK_SYSTEMD_SECRET_SOCKET}

The secret value is delivered back to systemd through the connection. Not intended for interactive use.

Exit codes

The command exits with a code describing the retrieval outcome. SDK wrappers can rely on these codes to react to specific failures.

Outcome	Ordinary	Systemd
Success	0	0
Secret not found	1	1
Provider locked	2	2
Plug not connected	3	0
Multiple matching secrets	4	4
Other retrieval failure	255	255

With --systemd, an unconnected plug is not a failure: the command exits successfully with an empty credential and writes a diagnostic to standard error, so the requesting unit can start without the secret. Other outcomes use the same code as an ordinary invocation.

workshopctl set-health¶

Report the health of the SDK.