diff --git a/apps/piquelctl/src/cli.rs b/apps/piquelctl/src/cli.rs index 946527575..67de359a9 100644 --- a/apps/piquelctl/src/cli.rs +++ b/apps/piquelctl/src/cli.rs @@ -533,7 +533,7 @@ pub(crate) struct CreateArgs { #[command(flatten)] pub(crate) deployment: DeploymentArgs, /// Skip the confirmation prompt. - #[arg(long)] + #[arg(long, short)] pub(crate) yes: bool, } @@ -604,7 +604,7 @@ pub(crate) struct ApplyArgs { pub(crate) expected_generation: Option, /// Skip the confirmation prompt. - #[arg(long)] + #[arg(long, short)] pub(crate) yes: bool, /// Replace whichever application has the manifest's name now, or create it. @@ -650,7 +650,7 @@ pub(crate) struct DeletionFlags { pub(crate) expected_generation: Option, /// Skip the confirmation prompt. - #[arg(long)] + #[arg(long, short)] pub(crate) yes: bool, /// Skip the generation check. @@ -787,7 +787,7 @@ pub(crate) struct OperationFlags { #[arg(long, value_name = "GENERATION")] pub(crate) expected_generation: Option, /// Skip the confirmation prompt. - #[arg(long)] + #[arg(long, short)] pub(crate) yes: bool, /// Return once the daemon accepts the operation, without waiting for it to end. #[arg(long)] diff --git a/apps/piquelctl/src/deployments.rs b/apps/piquelctl/src/deployments.rs index d741748ac..02069b099 100644 --- a/apps/piquelctl/src/deployments.rs +++ b/apps/piquelctl/src/deployments.rs @@ -371,7 +371,7 @@ pub(crate) struct RestoreArgs { /// The deployment to restore, as `history` lists it; it must have succeeded. deployment: String, /// Skip the interactive confirmation prompt. - #[arg(long)] + #[arg(long, short)] yes: bool, /// Return after the daemon accepts the restore. #[arg(long)] diff --git a/apps/piquelctl/src/editing/mod.rs b/apps/piquelctl/src/editing/mod.rs index 4c3b9f312..55cec7185 100644 --- a/apps/piquelctl/src/editing/mod.rs +++ b/apps/piquelctl/src/editing/mod.rs @@ -100,7 +100,7 @@ pub(crate) struct EditFlags { #[arg(long, conflicts_with = "expected_generation")] force: bool, /// Skip the confirmation prompt. You need it when not on a terminal. - #[arg(long)] + #[arg(long, short)] yes: bool, } // Declares edit argument structs: a flattened target followed by one `value`, diff --git a/apps/piquelctl/src/editing/repositories.rs b/apps/piquelctl/src/editing/repositories.rs index 1e5d6a57e..0c9611ba0 100644 --- a/apps/piquelctl/src/editing/repositories.rs +++ b/apps/piquelctl/src/editing/repositories.rs @@ -110,7 +110,7 @@ pub(crate) enum WebhookCommand { /// Application name or stable ID. app: String, /// Skip the confirmation prompt. You need it when not on a terminal. - #[arg(long)] + #[arg(long, short)] yes: bool, }, } diff --git a/apps/piquelctl/src/environments.rs b/apps/piquelctl/src/environments.rs index e1d522bfb..ae862d8c9 100644 --- a/apps/piquelctl/src/environments.rs +++ b/apps/piquelctl/src/environments.rs @@ -167,12 +167,6 @@ pub(crate) enum EnvCommand { }, /// List, regenerate, or delete an environment's generated secrets. Secret { - /// Application name or stable ID. - application: String, - /// Environment name or stable ID. You can omit it when the - /// application has exactly one environment. - #[arg(long = "env", value_name = "ENV")] - environment: Option, #[command(subcommand)] action: crate::secrets::GeneratedSecretAction, }, @@ -228,7 +222,7 @@ pub(crate) struct ChangeFlags { #[arg(long, value_name = "GENERATION")] expected_generation: Option, /// Skip the confirmation prompt. You need it when not on a terminal. - #[arg(long)] + #[arg(long, short)] yes: bool, /// Change the environment even if the application changed since the /// command read it. It still asks for confirmation. @@ -262,15 +256,7 @@ impl EnvCommand { Self::Show(target) => show(client, console, target).await, Self::Visibility(args) => args.run(client, console).await, Self::Rollback(args) => args.run(client, console).await, - Self::Secret { - application, - environment, - action, - } => { - action - .run(client, console, application, environment.as_deref()) - .await - } + Self::Secret { action } => action.run(client, console).await, Self::Rename(args) => args.run(client, console).await, Self::Delete(args) => args.run(client, console).await, Self::Deploy { @@ -634,15 +620,19 @@ pub(crate) struct PromoteArgs { /// or not. #[arg(long)] plan: bool, + /// Promote even if the application changed since the command read it. + /// It still asks for confirmation. + #[arg(long, conflicts_with = "expected_generation")] + force: bool, #[command(flatten)] flags: OperationFlags, } impl PromoteArgs { /// Plans, or confirms and promotes, the selected release, guarded by the - /// expected generation, defaulting to the current one. Waits unless - /// `--no-wait`. A plan listing unusable secrets fails as a conflict, - /// since promoting would. + /// expected generation, defaulting to the current one, unless `--force`. + /// Waits unless `--no-wait`. A plan listing unusable secrets fails as a + /// conflict, since promoting would. async fn run(&self, client: &Client, console: &mut Console) -> Result<()> { let (application, environment) = select(client, &self.application, Some(&self.environment)).await?; @@ -686,12 +676,13 @@ impl PromoteArgs { ), ) .await?; - request.expected_generation = Some( + request.expected_generation = (!self.force).then(|| { self.flags .expected_generation - .unwrap_or(application.generation), - ); - let accepted = retry_transport(|| client.promote_environment(id, &request, false)).await?; + .unwrap_or(application.generation) + }); + let accepted = + retry_transport(|| client.promote_environment(id, &request, self.force)).await?; let report = PromotionReport::new(&application, &accepted); if self.flags.no_wait { return console.emit(&report); diff --git a/apps/piquelctl/src/lib.rs b/apps/piquelctl/src/lib.rs index 8865fb1de..8cf0cdb07 100644 --- a/apps/piquelctl/src/lib.rs +++ b/apps/piquelctl/src/lib.rs @@ -308,6 +308,62 @@ mod tests { } } + #[test] + fn parser_takes_env_secret_targets_positionally_and_short_yes() { + for arguments in [ + &["piquelctl", "env", "secret", "list", "notes"][..], + &["piquelctl", "env", "secret", "list", "notes", "staging"], + &[ + "piquelctl", + "env", + "secret", + "regenerate", + "notes", + "staging", + "db", + "-y", + ], + &[ + "piquelctl", + "env", + "secret", + "delete", + "notes", + "staging", + "db", + "-y", + ], + &[ + "piquelctl", + "env", + "promote", + "notes", + "production", + "--force", + "-y", + ], + &["piquelctl", "app", "delete", "notes", "-y"], + ] { + Cli::try_parse_from(arguments).expect("command parses"); + } + for arguments in [ + // A generated secret is always named in one environment. + &["piquelctl", "env", "secret", "regenerate", "notes", "db"][..], + &[ + "piquelctl", + "env", + "promote", + "notes", + "production", + "--force", + "--expected-generation", + "3", + ], + ] { + assert!(Cli::try_parse_from(arguments).is_err(), "{arguments:?}"); + } + } + #[test] fn parser_rejects_conflicting_transports_and_invalid_timeout() { assert!( diff --git a/apps/piquelctl/src/notifications.rs b/apps/piquelctl/src/notifications.rs index 709e9033c..13cc0a1ab 100644 --- a/apps/piquelctl/src/notifications.rs +++ b/apps/piquelctl/src/notifications.rs @@ -6,7 +6,7 @@ use crate::{ commands::{fold_applications, resolve_application}, error::{CliError, ErrorKind, Result}, output::{Console, reports::report}, - support::{PageArgs, read_input}, + support::{PageArgs, read_hidden}, }; use clap::{ Args, Subcommand, @@ -20,11 +20,7 @@ use piqueld_client::{ NotificationDestination, NotificationMessage, }, }; -use std::{ - collections::BTreeMap, - io::{self, Read}, - path::{Path, PathBuf}, -}; +use std::{collections::BTreeMap, path::PathBuf}; // `notification` subcommands; `///` on variants and fields is user-facing help. #[derive(Debug, Subcommand)] @@ -233,28 +229,25 @@ impl SetArgs { Ok(settings) } - /// Reads the URL from `--url-file` or stdin, if either was given. - async fn url(&self) -> Result> { + /// Reads the URL from `--url-file` or stdin, if either was given. A + /// terminal is asked for it without echo, since it holds a credential. + /// Refuses more than 8 KiB, more than any webhook URL needs. + async fn url(&self, console: &mut Console) -> Result> { if self.url_file.is_none() && !self.url_stdin { return Ok(None); } - let file = self.url_file.clone(); - // Stdin can block indefinitely; read off the runtime so Ctrl-C stays responsive. - let url = read_input("destination URL", move || Self::read_url(file.as_deref())).await?; + let url = read_hidden(console, "destination URL", self.url_file.clone(), 8192).await?; + if url.len() > 8192 { + return Err(CliError::new( + ErrorKind::Input, + "the destination URL must be at most 8192 bytes", + )); + } + let url = String::from_utf8(url).map_err(|_| { + CliError::new(ErrorKind::Input, "the destination URL must be UTF-8 text") + })?; Ok(Some(url.trim().to_owned())) } - - /// Reads at most 8 KiB, more than any webhook URL needs. - fn read_url(file: Option<&Path>) -> io::Result { - let input: Box = if let Some(path) = file { - Box::new(std::fs::File::open(path)?) - } else { - Box::new(io::stdin()) - }; - let mut url = String::new(); - input.take(8192).read_to_string(&mut url)?; - Ok(url) - } } impl NotificationCommand { @@ -276,7 +269,7 @@ impl NotificationCommand { .iter() .find(|destination| destination.name.as_str() == args.name); let settings = args.apply(client, current.map(|d| &d.settings)).await?; - let url = args.url().await?; + let url = args.url(console).await?; if current.is_none() && url.is_none() { return Err(CliError::new( ErrorKind::Input, diff --git a/apps/piquelctl/src/previews.rs b/apps/piquelctl/src/previews.rs index 55a988978..0201b2616 100644 --- a/apps/piquelctl/src/previews.rs +++ b/apps/piquelctl/src/previews.rs @@ -176,7 +176,7 @@ pub(crate) struct PreviewArgs { #[derive(Debug, Args)] pub(crate) struct PreviewDeletionFlags { /// Skip the confirmation prompt. You need it when not on a terminal. - #[arg(long)] + #[arg(long, short)] yes: bool, /// Return once the daemon accepts the deletion, without waiting for it /// to finish. diff --git a/apps/piquelctl/src/secrets.rs b/apps/piquelctl/src/secrets.rs index 0eb7537fa..30e0b7be6 100644 --- a/apps/piquelctl/src/secrets.rs +++ b/apps/piquelctl/src/secrets.rs @@ -1,22 +1,20 @@ //! Secret values come from a file or stdin, never shell arguments or output. use crate::{ commands::resolve_application, + deployments::Target, + environments::{EnvironmentArgs, NamedEnvironment}, error::{CliError, ErrorKind, Result}, output::{ Console, reports::{NameDeletionReport, StoredSecretReport, StoredSecretsReport}, }, - support::{TerminalMode, read_input}, + support::read_hidden, }; use clap::{Args, Subcommand}; use piqueld_client::{ ApplicationView, Client, EnvironmentAccess, MAX_SECRET_VALUE_BYTES, SecretAccess, }; -use rustix::termios::{LocalModes, Termios}; -use std::{ - io::{self, BufRead, IsTerminal, Read}, - path::PathBuf, -}; +use std::path::PathBuf; // `app secret` subcommands; `///` on variants and fields is user-facing help. #[derive(Debug, Subcommand)] @@ -216,7 +214,13 @@ impl SecretAction { ), ) .await?; - let value = Self::read_value(console, file.clone()).await?; + let value = read_hidden( + console, + "secret value", + file.clone(), + MAX_SECRET_VALUE_BYTES as u64, + ) + .await?; if value.is_empty() || value.len() > MAX_SECRET_VALUE_BYTES { return Err(CliError::new( ErrorKind::Input, @@ -265,52 +269,6 @@ impl SecretAction { } Ok(()) } - /// Reads the value from `file` verbatim, or from stdin without one - /// trailing newline, so `echo value |` stores `value`. A terminal is - /// asked for one line, without echoing it. Reads at most the limit plus a - /// CRLF and one byte, so input still too long once the newline is - /// dropped is detected rather than cut short. Reads run off the runtime, - /// since stdin can block indefinitely and Ctrl-C must stay responsive. - async fn read_value(console: &mut Console, file: Option) -> Result> { - let stdin = file.is_none(); - let terminal = stdin && io::stdin().is_terminal(); - // Dropped with this future, so echo also returns when Ctrl-C - // interrupts the read. - let _hidden = if terminal { - console.prompt("Secret value (hidden): ")?; - let hide = |mode: &mut Termios| { - mode.local_modes.remove(LocalModes::ECHO); - mode.local_modes.insert(LocalModes::ECHONL); - }; - Some(TerminalMode::enable(hide).map_err(|error| { - CliError::new( - ErrorKind::General, - format!("could not hide terminal input: {error}"), - ) - })?) - } else { - None - }; - let mut value = read_input("secret", move || { - let input: Box = match file { - Some(path) => Box::new(std::fs::File::open(path)?), - None => Box::new(io::stdin()), - }; - let mut input = io::BufReader::new(input.take(MAX_SECRET_VALUE_BYTES as u64 + 3)); - let mut bytes = Vec::new(); - if terminal { - input.read_until(b'\n', &mut bytes)?; - } else { - input.read_to_end(&mut bytes)?; - } - Ok(bytes) - }) - .await?; - if stdin && value.pop_if(|byte| *byte == b'\n').is_some() { - value.pop_if(|byte| *byte == b'\r'); - } - Ok(value) - } } // `env secret` subcommands; `///` on variants and fields is user-facing help. @@ -319,39 +277,46 @@ pub(crate) enum GeneratedSecretAction { /// List the environment's generated secrets. /// /// It shows each secret's version, never its value. - List, + List(EnvironmentArgs), /// Generate a new value for a generated secret. /// /// Use it to rotate a value, or to replace one that `secrets recover-key` /// discarded. The next deployment uses it; running services keep theirs /// until then. Needs `secrets:write`. - Regenerate(SecretChange), + Regenerate(GeneratedSecretChange), /// Delete a generated secret that nothing uses. /// /// It fails while the configuration or a deployment still uses the secret. /// A later deployment that mounts it generates a new value. Needs /// `secrets:write`. - Delete(SecretChange), + Delete(GeneratedSecretChange), +} + +// A generated secret of one named environment to delete or regenerate. +#[derive(Debug, Args)] +pub(crate) struct GeneratedSecretChange { + #[command(flatten)] + target: NamedEnvironment, + #[command(flatten)] + change: SecretChange, } impl GeneratedSecretAction { - /// Runs a generated-secret action for the named environment of - /// `application`, or its only environment. - pub(crate) async fn run( - &self, - client: &Client, - console: &mut Console, - application: &str, - environment: Option<&str>, - ) -> Result<()> { - let (application, environment) = - crate::environments::select(client, application, environment).await?; + /// Runs a generated-secret action: `list` for the named environment of + /// the application, or its only one; the others for the named one. + pub(crate) async fn run(&self, client: &Client, console: &mut Console) -> Result<()> { + let (application, environment) = match self { + Self::List(target) => target.resolve(client).await?, + Self::Regenerate(change) | Self::Delete(change) => { + change.target.resolve(client).await? + } + }; let id = environment.id.as_str(); let metadata = client.secrets(id).await?; let (verb, change) = match self { - Self::List => return console.emit(&metadata), - Self::Regenerate(change) => ("Regenerate", change), - Self::Delete(change) => ("Delete", change), + Self::List(_) => return console.emit(&metadata), + Self::Regenerate(change) => ("Regenerate", &change.change), + Self::Delete(change) => ("Delete", &change.change), }; let name = &change.name; let current = metadata.iter().find(|secret| secret.name == *name); @@ -392,7 +357,7 @@ pub(crate) enum KeyAction { /// Needs `system:operate`. RecoverKey { /// Skip the confirmation prompt. - #[arg(long)] + #[arg(long, short)] yes: bool, }, } diff --git a/apps/piquelctl/src/support.rs b/apps/piquelctl/src/support.rs index 1edc79ae1..3a56f543d 100644 --- a/apps/piquelctl/src/support.rs +++ b/apps/piquelctl/src/support.rs @@ -1,13 +1,16 @@ //! Shared helpers: blocking operator input, file reading, retries, and small //! formatting utilities. -use crate::error::{CliError, ErrorKind, Result}; +use crate::{ + error::{CliError, ErrorKind, Result}, + output::Console, +}; use piqueld_client::ClientError; -use rustix::termios::{OptionalActions, Termios, tcgetattr, tcsetattr}; +use rustix::termios::{LocalModes, OptionalActions, Termios, tcgetattr, tcsetattr}; use serde_json::json; use std::{ fmt, future::Future, - io::{self, Read}, + io::{self, BufRead, IsTerminal, Read}, num::NonZeroU64, path::{Path, PathBuf}, sync::{ @@ -145,6 +148,62 @@ pub(crate) async fn read_input( }) } +/// Reads `what`, such as a secret value, from `file` verbatim, or from stdin +/// without one trailing newline, so `echo value |` gives `value`. A terminal +/// is asked for one line, without echoing it. Reads at most `limit` plus a +/// CRLF and one byte, so input still too long once the newline is dropped is +/// detected rather than cut short. Reads run off the runtime, since stdin can +/// block indefinitely and Ctrl-C must stay responsive. +pub(crate) async fn read_hidden( + console: &mut Console, + what: &'static str, + file: Option, + limit: u64, +) -> Result> { + let stdin = file.is_none(); + let terminal = stdin && io::stdin().is_terminal(); + // Dropped with this future, so echo also returns when Ctrl-C + // interrupts the read. + let _hidden = if terminal { + let mut prompt = what.to_owned(); + if let Some(first) = prompt.get_mut(..1) { + first.make_ascii_uppercase(); + } + console.prompt(&format!("{prompt} (hidden): "))?; + let hide = |mode: &mut Termios| { + mode.local_modes.remove(LocalModes::ECHO); + mode.local_modes.insert(LocalModes::ECHONL); + }; + Some(TerminalMode::enable(hide).map_err(|error| { + CliError::new( + ErrorKind::General, + format!("could not hide terminal input: {error}"), + ) + })?) + } else { + None + }; + let mut value = read_input(what, move || { + let input: Box = match file { + Some(path) => Box::new(std::fs::File::open(path)?), + None => Box::new(io::stdin()), + }; + let mut input = io::BufReader::new(input.take(limit + 3)); + let mut bytes = Vec::new(); + if terminal { + input.read_until(b'\n', &mut bytes)?; + } else { + input.read_to_end(&mut bytes)?; + } + Ok(bytes) + }) + .await?; + if stdin && value.pop_if(|byte| *byte == b'\n').is_some() { + value.pop_if(|byte| *byte == b'\r'); + } + Ok(value) +} + /// Standard input's terminal in a changed mode, e.g. raw or without echo; /// dropping it restores the original mode. pub(crate) struct TerminalMode(Termios); diff --git a/apps/piquelctl/tests/cli.rs b/apps/piquelctl/tests/cli.rs index a7b565f9a..a61d68cda 100644 --- a/apps/piquelctl/tests/cli.rs +++ b/apps/piquelctl/tests/cli.rs @@ -3470,11 +3470,7 @@ fn promotion_commands_name_environments_and_report_the_pinned_release() { "POST", "/api/v1/environments/app-notes-01/promote", json!({"deployment": "operation-01", "expected_generation": 1}), - Reply::accepted(json!({ - "operation_id": "operation-02", "environment_id": "app-notes-01", "generation": 1, - "release_id": "rel-0123456789abcdef", - "origin": {"type": "promotion", "environment": "env-staging-01", "deployment": "operation-01"} - })), + promotion_accepted(), ); let output = run( &server, @@ -3497,6 +3493,44 @@ fn promotion_commands_name_environments_and_report_the_pinned_release() { let _ = server.finish(); } +/// The accepted promotion of staging's `operation-01` into production. +fn promotion_accepted() -> Reply { + Reply::accepted(json!({ + "operation_id": "operation-02", "environment_id": "app-notes-01", "generation": 1, + "release_id": "rel-0123456789abcdef", + "origin": {"type": "promotion", "environment": "env-staging-01", "deployment": "operation-01"} + })) +} + +/// `env promote --force` sends no expected generation and asks the daemon +/// to skip that precondition. +#[test] +fn promote_force_sends_no_expected_generation() { + let server = request_server( + promoted_view(), + "POST", + "/api/v1/environments/app-notes-01/promote?force=true", + json!({"deployment": "operation-01"}), + promotion_accepted(), + ); + let output = run( + &server, + &[ + "env", + "promote", + "app-notes-01", + "production", + "--deployment", + "operation-01", + "--force", + "--yes", + "--no-wait", + ], + ); + assert_eq!(assert_json_success(&output)["operation_id"], "operation-02"); + let _ = server.finish(); +} + /// `env rollback` saves the environment's rollback by name, and `default` /// clears it. #[test] @@ -3883,6 +3917,48 @@ fn json_errors_are_one_envelope_on_stderr() { assert!(error["message"].as_str().unwrap().contains("required")); } +/// `notification set --url-stdin` refuses a URL longer than any webhook's +/// rather than cutting it. +#[test] +fn notification_urls_over_8_kib_are_refused() { + let server = start_server(false, 1, |request| match request.path.as_str() { + "/api/v1/notifications/destinations" => Reply::json(json!([])), + path => panic!("unexpected path {path}"), + }); + let mut child = server + .command() + .args([ + "--json", + "notification", + "set", + "ops", + "--kind", + "discord", + "--url-stdin", + ]) + .stdin(Stdio::piped()) + .stdout(Stdio::piped()) + .stderr(Stdio::piped()) + .spawn() + .expect("piquelctl process"); + let url = format!("https://discord.com/api/webhooks/{}", "a".repeat(8192)); + child + .stdin + .take() + .expect("child stdin") + .write_all(url.as_bytes()) + .expect("URL is written"); + let output = child.wait_with_output().expect("piquelctl exits"); + assert_eq!(output.status.code(), Some(2), "{output:?}"); + assert!( + support::json_error(&output)["message"] + .as_str() + .unwrap() + .contains("at most 8192 bytes") + ); + let _ = server.finish(); +} + /// `notification deliveries` reads the requested page, showing when each /// delivery changed or, while pending, is next attempted; `retry` fails with /// the reason the daemon refused it. diff --git a/crates/piqueld-core/src/api.rs b/crates/piqueld-core/src/api.rs index d62d2f151..0f0e06665 100644 --- a/crates/piqueld-core/src/api.rs +++ b/crates/piqueld-core/src/api.rs @@ -1265,7 +1265,7 @@ pub struct PromoteRequest { #[serde(default, skip_serializing_if = "Option::is_none")] pub release: Option, /// Current application revision, required unless explicitly forced; ignored by plans. - #[serde(default)] + #[serde(default, skip_serializing_if = "Option::is_none")] pub expected_generation: Option, } diff --git a/docs/user/applications/secrets-and-variables.md b/docs/user/applications/secrets-and-variables.md index a8c43064a..6df6c4f4d 100644 --- a/docs/user/applications/secrets-and-variables.md +++ b/docs/user/applications/secrets-and-variables.md @@ -389,7 +389,7 @@ In the dashboard, open the environment's **Secrets** tab, and select `piquelctl`: ```console -$ piquelctl env secret notes regenerate db-password +$ piquelctl env secret regenerate notes production db-password Generated db-password generation 2. Deploy the environment to use it. ``` @@ -402,8 +402,9 @@ ALTER USER notes PASSWORD :'pw'; EOF ``` -When the application has several environments, add `--env ` to -`env secret` and `app exec`. +`env secret regenerate` takes the environment as its second argument, as +above. When the application has several environments, also add +`--env ` to `app exec`. ## Delete a secret @@ -422,7 +423,7 @@ database that stored the old one doesn't know. Select **Delete** next to it under **Generated secrets**, on the environment's **Secrets** tab, or run: ```console -piquelctl env secret notes delete +piquelctl env secret delete notes production ``` Removing a declaration from `spec.secrets` keeps the values already generated. diff --git a/docs/user/operations/notifications.md b/docs/user/operations/notifications.md index e75e75665..24a683f7b 100644 --- a/docs/user/operations/notifications.md +++ b/docs/user/operations/notifications.md @@ -35,14 +35,15 @@ In the dashboard: With `piquelctl`: -1. Create the destination, then paste the webhook URL and press Ctrl-D: +1. Create the destination, then paste the webhook URL and press Enter: ```console piquelctl notification set ops --kind discord --url-stdin ``` `ops` is its name. The URL is read from standard input rather than the - command line, so it stays out of your shell's history. + command line, so it stays out of your shell's history, and it isn't shown + as you paste it. 2. Send a test notification: diff --git a/docs/user/reference/cli-commands.md b/docs/user/reference/cli-commands.md index a2d1abd11..11eeaf4af 100644 --- a/docs/user/reference/cli-commands.md +++ b/docs/user/reference/cli-commands.md @@ -632,7 +632,7 @@ piquelctl secrets recover-key [OPTIONS] Options: -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. ## `piquelctl notification` @@ -875,7 +875,7 @@ Options: - `--deploy`: Also deploy the saved configuration. - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. ## `piquelctl app service` @@ -926,7 +926,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--git `: Build this Git repository with Docker instead of running an image. It takes a clone URL, a path on the daemon's host, or `self`: the manifest's own repository, at the commit the manifest was read from. - `--branch `: Branch to build when no commit is pinned. Default: `main`. `self` doesn't take one. - `--commit `: Build this full commit hash instead of the branch head. `self` doesn't take one. @@ -956,7 +956,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service rename` @@ -980,7 +980,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service replicas` @@ -1002,7 +1002,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service source` @@ -1044,7 +1044,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service source git` @@ -1068,7 +1068,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--branch `: Branch to build when no commit is pinned. Default: `main`. `self` doesn't take one. - `--commit `: Build this full commit hash instead of the branch head. `self` doesn't take one. - `--dockerfile `: Dockerfile path, relative to the repository root. Default: `Dockerfile`. @@ -1096,7 +1096,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service source branch` @@ -1118,7 +1118,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service source commit` @@ -1140,7 +1140,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--clear`: Remove the pinned commit and build the branch head again. ## `piquelctl app service source dockerfile` @@ -1163,7 +1163,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service source context` @@ -1185,7 +1185,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service env` @@ -1221,7 +1221,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service env remove` @@ -1245,7 +1245,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service command` @@ -1269,7 +1269,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service arguments` @@ -1293,7 +1293,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service depends-on` @@ -1317,7 +1317,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service rollout` @@ -1340,7 +1340,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--order `: `stop-first` stops the old task before starting its replacement, and `start-first` starts the replacement first. By default, the order is `stop-first` when the service mounts a volume writable, else `start-first`. - `--monitor-seconds `: Seconds Docker watches each replacement task for failure, from 1 to 3600. By default, 30. @@ -1366,7 +1366,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service mount` @@ -1402,7 +1402,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--read-only`: Mount the volume read-only. A writable mount makes the service's rollouts stop the old task first. ## `piquelctl app service mount remove` @@ -1425,7 +1425,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service secret` @@ -1479,7 +1479,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service secret remove` @@ -1503,7 +1503,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service health` @@ -1550,7 +1550,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--path `: Request path, starting with `/`. Default: `/health`. - `--interval `: Seconds between checks, from 1 to 3600. Default: `10`. - `--check-timeout `: Seconds before a check counts as failed, from 1 to the interval. Default: `3`. @@ -1579,7 +1579,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--interval `: Seconds between checks, from 1 to 3600. Default: `10`. - `--check-timeout `: Seconds before a check counts as failed, from 1 to the interval. Default: `3`. - `--start-period `: Seconds after the container starts during which failed checks don't count, up to 3600. A passing check makes the container healthy at once. Default: `0`. @@ -1604,7 +1604,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service health port` @@ -1626,7 +1626,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service health path` @@ -1648,7 +1648,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service health command-elements` @@ -1670,7 +1670,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service health interval` @@ -1692,7 +1692,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service health timeout` @@ -1714,7 +1714,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service health start-period` @@ -1736,7 +1736,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service health retries` @@ -1758,7 +1758,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app service cpu` @@ -1780,7 +1780,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--clear`: Remove the CPU limit. ## `piquelctl app service memory` @@ -1803,7 +1803,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--clear`: Remove the memory limit. ## `piquelctl app file` @@ -1855,7 +1855,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--content `: The file's content. Variables in it are never rendered. - `--from `: Read the content from this local file now, and save it in the manifest. - `--path `: Read the content from this file in the manifest's repository, relative to its root, each time a deployment fetches the manifest. Only repository-backed applications can use it. @@ -1881,7 +1881,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app volume` @@ -1917,7 +1917,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app volume remove` @@ -1940,7 +1940,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app route` @@ -1994,7 +1994,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--visibility `: `public` serves everyone, `private` only devices on the tailnet. The environment's visibility ceiling can make it stricter. Default: `private`. Values: `public`, `private`. - `--name `: Stable route name, unique within the application. It selects the route in every environment and preview, such as with `env url --route`. @@ -2018,7 +2018,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--status `: HTTP status of the redirect: `301`, `302`, `303`, `307` or `308`. Default: `308`. - `--no-preserve-path`: Drop the request path and query instead of appending them to the destination. - `--visibility `: `public` serves everyone, `private` only devices on the tailnet. The environment's visibility ceiling can make it stricter. Default: `private`. Values: `public`, `private`. @@ -2046,7 +2046,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app route name` @@ -2070,7 +2070,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app route remove` @@ -2091,7 +2091,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app job` @@ -2130,7 +2130,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--timeout-seconds `: Seconds the job may run before it fails the deployment, from 1 to 86400. By default, the job's current timeout, or 300 for a new job. - `--volume-access `: How the job mounts its service's volumes. By default, the job's current access, or `read-only` for a new job. - `read-only`: Mount every volume read-only, so the job runs beside the services. @@ -2161,7 +2161,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app job remove` @@ -2182,7 +2182,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app export` @@ -2231,7 +2231,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--applications `: Applications whose environments may import the service. Separate several with commas, or repeat the option. Required. - `--previews`: Let previews of those applications import it too. Without it, previews can't, even if they could before. @@ -2254,7 +2254,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app import` @@ -2306,7 +2306,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--environment `: Environment of the exporting application to reach, such as `staging` or `${{ vars.auth_env }}`. By default, the one named like the importing environment. ## `piquelctl app import remove` @@ -2329,7 +2329,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app variable` @@ -2368,7 +2368,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--string`: Keep the value as text even when it looks like a boolean or an integer. ## `piquelctl app variable unset` @@ -2394,7 +2394,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app repository` @@ -2436,7 +2436,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--branch `: Branch the environments follow. Default: `main`. - `--commit `: Pin this full commit hash instead of following the branch. - `--sync `: Whether to deploy pushes, as `app repository sync` sets it. Default: `off`. @@ -2465,7 +2465,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app repository url` @@ -2486,7 +2486,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app repository path` @@ -2507,7 +2507,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app repository sync` @@ -2533,7 +2533,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--interval `: Seconds between polls with `poll`, from 60 to 86400. By default, 300. ## `piquelctl app repository reset` @@ -2556,7 +2556,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app repository webhook` @@ -2601,7 +2601,7 @@ Arguments: Options: -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app list` @@ -2722,7 +2722,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--bytes `: Generate this many random bytes (16–512), encoded as text. - `--encoding `: Text encoding of the random bytes. @@ -2752,7 +2752,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app secret` @@ -2906,7 +2906,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation; `0` requires that it doesn't exist. Defaults to the generation it inspects, or `0` when no application has the manifest's name. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--force`: Replace whichever application has the manifest's name now, or create it. It skips the generation and identity checks, but still asks for confirmation. @@ -2933,7 +2933,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Defaults to the generation it inspects. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--force`: Skip the generation check. It still asks for confirmation. @@ -2958,7 +2958,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Without it, a deployment uses the generation it inspects, and a retry checks none. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--no-wait`: Return once the daemon accepts the operation, without waiting for it to end. ## `piquelctl app stop` @@ -2980,7 +2980,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Without it, a deployment uses the generation it inspects, and a retry checks none. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--no-wait`: Return once the daemon accepts the operation, without waiting for it to end. ## `piquelctl app start` @@ -3002,7 +3002,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Without it, a deployment uses the generation it inspects, and a retry checks none. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--no-wait`: Return once the daemon accepts the operation, without waiting for it to end. ## `piquelctl app deploy` @@ -3024,7 +3024,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Without it, a deployment uses the generation it inspects, and a retry checks none. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--no-wait`: Return once the daemon accepts the operation, without waiting for it to end. - `--branch `: Fetch the repository manifest from this branch, for this deployment only. @@ -3052,7 +3052,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl app manifest` @@ -3154,7 +3154,7 @@ Options: - `--commit `: Deploy this commit of `--branch` instead of the branch's head: a full commit hash of 40 or 64 lowercase hexadecimal characters. - `--promote-from `: Make the environment promoted: it never builds, and only receives releases promoted from this environment of the application, given by name or stable ID, with `env promote`. - `--expected-generation `: Change the environment only if the application's generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the command. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--force`: Change the environment even if the application changed since the command read it. It still asks for confirmation. ## `piquelctl env source` @@ -3177,7 +3177,7 @@ Options: - `--promote-from `: Receive releases promoted from this environment of the application, given by name or stable ID. - `--tracking`: Stop receiving promoted releases and build again: the saved manifest, or the branch `spec.manifest` names. Use `env branch` afterwards to follow another branch. - `--expected-generation `: Change the environment only if the application's generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the command. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--force`: Change the environment even if the application changed since the command read it. It still asks for confirmation. ## `piquelctl env promote` @@ -3200,10 +3200,11 @@ Options: - `--deployment `: Promote the release of this deployment of the source environment. The command fails if it is no longer the source's current deployment. - `--release `: Deploy this earlier release of the application instead, with the environment's current secrets. - `--plan`: Show what would be deployed, and any secret it can't use, without deploying. The command exits with code 3 if the promotion would be refused. With `--release`, you can plan for any environment, promoted or not. +- `--force`: Promote even if the application changed since the command read it. It still asks for confirmation. - `--expected-generation `: Fail unless the application is at this generation. Without it, a deployment uses the generation it inspects, and a retry checks none. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--no-wait`: Return once the daemon accepts the operation, without waiting for it to end. ## `piquelctl env branch` @@ -3226,7 +3227,7 @@ Options: - `--commit `: Deploy this commit of the branch instead of the branch's head: a full commit hash of 40 or 64 lowercase hexadecimal characters. Without it, the environment follows the branch's head, unpinning any commit. - `--expected-generation `: Change the environment only if the application's generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the command. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--force`: Change the environment even if the application changed since the command read it. It still asks for confirmation. ## `piquelctl env sync` @@ -3296,7 +3297,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl env rollback` @@ -3323,7 +3324,7 @@ Options: - `--no-wait`: Return once the change is saved, or its deployment accepted, without waiting for the deployment to end. - `--expected-generation `: Save only if the application's saved generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the save instead of being overwritten. - `--force`: Save even if the application changed since the command read it. It still asks for confirmation. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. ## `piquelctl env rename` @@ -3344,7 +3345,7 @@ Arguments: Options: - `--expected-generation `: Change the environment only if the application's generation is still `GENERATION`. By default, it must still be the generation the command read, so a concurrent change fails the command. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--force`: Change the environment even if the application changed since the command read it. It still asks for confirmation. ## `piquelctl env delete` @@ -3367,7 +3368,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Defaults to the generation it inspects. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--force`: Skip the generation check. It still asks for confirmation. @@ -3393,7 +3394,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Without it, a deployment uses the generation it inspects, and a retry checks none. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--no-wait`: Return once the daemon accepts the operation, without waiting for it to end. - `--branch `: Fetch the repository manifest from this branch, for this deployment only. @@ -3420,7 +3421,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Without it, a deployment uses the generation it inspects, and a retry checks none. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--no-wait`: Return once the daemon accepts the operation, without waiting for it to end. ## `piquelctl env stop` @@ -3443,7 +3444,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Without it, a deployment uses the generation it inspects, and a retry checks none. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--no-wait`: Return once the daemon accepts the operation, without waiting for it to end. ## `piquelctl env start` @@ -3466,7 +3467,7 @@ Options: - `--expected-generation `: Fail unless the application is at this generation. Without it, a deployment uses the generation it inspects, and a retry checks none. -- `--yes`: Skip the confirmation prompt. +- `-y, --yes`: Skip the confirmation prompt. - `--no-wait`: Return once the daemon accepts the operation, without waiting for it to end. ## `piquelctl env secret` @@ -3474,17 +3475,9 @@ Options: List, regenerate, or delete an environment's generated secrets. ```text -piquelctl env secret [OPTIONS] +piquelctl env secret [OPTIONS] ``` -Arguments: - -- ``: Application name or stable ID. - -Options: - -- `--env `: Environment name or stable ID. You can omit it when the application has exactly one environment. - Commands: - [`piquelctl env secret list`](#piquelctl-env-secret-list): List the environment's generated secrets. @@ -3498,9 +3491,14 @@ List the environment's generated secrets. It shows each secret's version, never its value. ```text -piquelctl env secret list [OPTIONS] +piquelctl env secret list [OPTIONS] [ENVIRONMENT] ``` +Arguments: + +- ``: Application name or stable ID. +- `[ENVIRONMENT]`: Environment name or stable ID. You can omit it when the application has exactly one environment. + ## `piquelctl env secret regenerate` Generate a new value for a generated secret. @@ -3508,11 +3506,13 @@ Generate a new value for a generated secret. Use it to rotate a value, or to replace one that `secrets recover-key` discarded. The next deployment uses it; running services keep theirs until then. Needs `secrets:write`. ```text -piquelctl env secret regenerate [OPTIONS] +piquelctl env secret regenerate [OPTIONS] ``` Arguments: +- ``: Application name or stable ID. +- ``: Environment name or stable ID. - ``: Secret name. Options: @@ -3529,11 +3529,13 @@ Delete a generated secret that nothing uses. It fails while the configuration or a deployment still uses the secret. A later deployment that mounts it generates a new value. Needs `secrets:write`. ```text -piquelctl env secret delete [OPTIONS] +piquelctl env secret delete [OPTIONS] ``` Arguments: +- ``: Application name or stable ID. +- ``: Environment name or stable ID. - ``: Secret name. Options: @@ -3598,7 +3600,7 @@ Arguments: Options: -- `--yes`: Skip the interactive confirmation prompt. +- `-y, --yes`: Skip the interactive confirmation prompt. - `--no-wait`: Return after the daemon accepts the restore. ## `piquelctl env wait` @@ -3799,7 +3801,7 @@ Arguments: Options: - `--slot `: The preview's slot. Needed to address a preview with a slot by its branch. -- `--yes`: Skip the interactive confirmation prompt. +- `-y, --yes`: Skip the interactive confirmation prompt. - `--no-wait`: Return after the daemon accepts the restore. ## `piquelctl preview wait` @@ -3886,7 +3888,7 @@ Arguments: Options: - `--slot `: The preview's slot. Needed to address a preview with a slot by its branch. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--no-wait`: Return once the daemon accepts the deletion, without waiting for it to finish. ## `piquelctl preview prune` @@ -3906,7 +3908,7 @@ Arguments: Options: - `--branch-gone`: Select the previews whose branch no longer exists. Required. Required. -- `--yes`: Skip the confirmation prompt. You need it when not on a terminal. +- `-y, --yes`: Skip the confirmation prompt. You need it when not on a terminal. - `--no-wait`: Return once the daemon accepts the deletion, without waiting for it to finish. ## `piquelctl builds` diff --git a/docs/user/reference/cli.md b/docs/user/reference/cli.md index e34a711c1..12fcb6fea 100644 --- a/docs/user/reference/cli.md +++ b/docs/user/reference/cli.md @@ -104,7 +104,8 @@ opting in while it is on, needs `apps:deploy` too. `notification set NAME` creates a destination, or changes one; options it omits keep the current settings, and a new destination receives every category but `deployment_succeeded` about every application, without previews. The URL is read from `--url-file` -or `--url-stdin`, never an argument, and is required to create one. `--kind +or `--url-stdin`, never an argument, and is required to create one. On a +terminal, `--url-stdin` asks for it without echoing it. `--kind json|discord` picks the payload, `--enabled true|false` pauses it, `--categories a,b` replaces the categories it receives, and `--message CATEGORY=TEXT` (repeatable) sends text with a category's @@ -229,7 +230,8 @@ deployment, after confirmation (`--yes`), and waits for it unless `--no-wait`. (`promotion_source_changed` once the source moved on); `--release ID` deploys an earlier release of the application with the environment's current secrets. `--expected-generation N` pins the application revision; by default the -inspected one is sent. It fails, before deploying anything, with +inspected one is sent. `--force` sends none, so the promotion goes ahead even if +the application changed meanwhile; it still asks for confirmation. It fails, before deploying anything, with `promotion_source_not_ready` unless the source's current deployment succeeded and runs healthy now, `release_incompatible`, `image_unavailable`, or `secrets_unavailable` listing every unusable secret. `env source --promote-from` @@ -1217,9 +1219,9 @@ deployment, to rotate a value or replace one discarded by key recovery; running deployments keep theirs. `delete` removes an unused one: ```sh -piquelctl env secret notes --env staging list -piquelctl env secret notes --env staging regenerate database-password --yes -piquelctl env secret notes --env staging delete database-password --yes +piquelctl env secret list notes staging +piquelctl env secret regenerate notes staging database-password --yes +piquelctl env secret delete notes staging database-password --yes ``` `env show` lists each secret the environment mounts and where its value comes @@ -1237,6 +1239,6 @@ piquelctl secrets recover-key --yes The command requires confirmation (`--yes` for automation), refuses while the current key still works, and reports affected environment, secret and version counts. Running Docker services are left alone. `app secret APP list` and -`env secret APP list` mark discarded values as unavailable; set replacement +`env secret list APP` mark discarded values as unavailable; set replacement stored values using the same names, then Deploy explicitly, which also generates new values for discarded generated secrets. diff --git a/docs/user/reference/manifest.md b/docs/user/reference/manifest.md index 6dcd40da4..a487e24b7 100644 --- a/docs/user/reference/manifest.md +++ b/docs/user/reference/manifest.md @@ -740,7 +740,7 @@ A value is generated when a deployment prepares its inputs, a service or job mounts the secret, and it has no stored value. Declarations that no service or job mounts are not generated, so they never count against secret quotas. A value is never changed afterwards: later applies, deploys, and edits to the declaration keep -it, so rotation stays explicit: `piquelctl env secret APP --env ENV regenerate NAME` +it, so rotation stays explicit: `piquelctl env secret regenerate APP ENV NAME` generates a new version for the next deployment. A value discarded by key recovery has nothing left to keep, so the next deployment that mounts it generates a new one. Removing a declaration retains the generated value.