Secrets and deployment snapshots

Resolve trusted secret-provider references and publish immutable, narrowly exported AWS environment snapshots.

Resolve 1Password references

Brix bundles its pinned Varlock 1Password plugin. Register it in the schema header:

# @plugin(brix)
# @initOp(token=$OP_SERVICE_ACCOUNT_TOKEN, allowAppAuth=true)
# @currentEnv=$VARLOCK_ENV
# @generateTsTypes(path=../src/env.generated.d.ts, auto=false, exposeEnv=none, processEnv=none, importMetaEnv=none)
# ---

# @type=opServiceAccountToken @sensitive @internal @required=false
OP_SERVICE_ACCOUNT_TOKEN=

# @type=string @sensitive @required
CATALOG_TOKEN=op("op://Storefront/Production/token")

No application plugin install is needed. Authenticate the 1Password CLI locally. In trusted CI, provide OP_SERVICE_ACCOUNT_TOKEN; it takes precedence. Plugins and imported schemas are executable trusted configuration, so never resolve providers in untrusted fork jobs.

Upload an immutable AWS snapshot

Configure the stable secret prefix and narrow CI export allowlist in package.json:

{
  "brix": {
    "project": "application",
    "env": {
      "secretsPrefix": "booking",
      "ciExports": {
        "literals": ["PORT"],
        "secrets": ["DEPLOY_TOKEN"]
      }
    }
  }
}

Run upload only in a protected deployment job:

brix env upload production

Upload validates the complete environment, checks sensitivity, masks sensitive values in GitHub Actions, and replaces <prefix>-secrets-<stage> with a complete brix-env-v1 JSON snapshot. Unlisted values remain in the AWS snapshot but do not cross into later CI steps.

Brix exports only STAGE, allowlisted values, SECRETS_ARN, and exact SECRETS_VERSION. Masking is log redaction, not access control; every later job step can read exports.

Deploy the ARN/version pair, AWS region, and workload identity. The Node runtime adapter fetches exactly that immutable version and supplies the snapshot to the inert createEnv parser for each request. Both identifiers are required together; malformed snapshots and provider failures do not fall back to process values. Production needs no Varlock files or provider credentials in its runtime artifact.