Bitrise secrets

Secrets a Bitrise workflow reads at build time.

The connection

What	This provider
Vendor	Bitrise
Key	`bitrise-secrets`
Availability	`available`. You can connect it today.
Credential penv holds	`bitrise-token`
Values read back	yes
Activation	`on-next-deploy`

Direction	What it does
`import`	Reads names and values out of the store into penv.
`export`	Writes names and values from penv into the store.

on-next-deploy. A new value waits there and arrives with your next deploy.

Direction	Policies you can pick
`import`	`skip_existing`, `new_version`, `fail`
`export`	`create_only`, `overwrite`, `overwrite_and_prune`

How syncs work says what each one does.

You paste a credential you already hold. penv seals it and never shows it again.

Field	Label	Kind	Required	What it is
`token`	Access token	secret, masked here and sealed	yes	Bitrise sends this raw, with no Bearer prefix.

Answered once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`appSlug`	App	text	yes	no	The slug in your Bitrise app URL.
`isProtected`	Hide values from the API	yes or no	no	yes	One way: once hidden, a value cannot be read back or changed, only deleted and remade. Starts at `false`.
`isExposedForPullRequests`	Expose to pull requests	yes or no	no	yes	Builds from forks would read it. Starts at `false`.
`expandInStepInputs`	Expand in step inputs	yes or no	no	yes	Starts at `false`.

penv probes for these when it verifies the connection.

Permission	Directions	Blocking	Without it
`apps:read`	every direction	yes	Preview cannot list the app's secrets.
`apps:write`	`export`	yes	Export cannot write anything.