Add CLI commands for vaults, secrets, and vars management#428
Merged
Add CLI commands for vaults, secrets, and vars management#428
Conversation
Adds a new command to create vaults with optional `--unlocked` and `--repository-permission` flags. Wires up POST /mint/api/vaults.
Restructures secrets into `rwx vaults secrets set` and adds `rwx vaults secrets delete`. The old `set-secrets` command remains as a hidden alias. Wires up DELETE /mint/api/vaults/secrets/:id.
Adds the vars subcommand group with a `set` command that supports KEY=value args and --file for dotenv input, matching the secrets set UX. Calls POST /mint/api/vaults/vars once per var sequentially.
Adds a command to retrieve a var's value from a vault. Wires up GET /mint/api/vaults/vars/:id.
Adds a command to delete a var from a vault. Wires up DELETE /mint/api/vaults/vars/:id.
d658ff5 to
6c53f88
Compare
Destructive delete commands (secrets and vars) now require confirmation. In TTY environments, the user is prompted interactively. In non-TTY environments (e.g. coding agents, CI), --yes/-y must be passed explicitly to prevent the command from hanging on stdin.
TAGraves
approved these changes
Mar 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR wraps our existing Mint API endpoints in CLI commands for convenience. One somewhat noticeable gap here is that we don't have an endpoint today for updating a vault itself, and the create endpoint doesn't support specifying user permissions or approvals. We can add those separately if desired, but this PR just wraps what the server already supports.
Summary
rwx vaults createcommand with--name,--unlocked, and--repository-permissionflagsrwx vaults secrets set,rwx vaults secrets deletesubcommands (keepsset-secretsas hidden alias)rwx vaults vars set,rwx vaults vars show,rwx vaults vars deletesubcommands--vault(default: "default"),--output json, and--access-tokenPOST /mint/api/vaults,DELETE /mint/api/vaults/secrets/:id,POST /mint/api/vaults/vars,GET /mint/api/vaults/vars/:id,DELETE /mint/api/vaults/vars/:idTest plan