Add secrets list and rm to the CLI

docs/operations.md

@@ -421,9 +421,14 @@ Symptoms and levers:
 Secrets are gated at **dispatch**, by the decider, through job-role variant
 selection — not at synth time.
 
-1. **Is the secret written?** `millwright secrets set <name> [--scope <scope>]`
-   writes `/millwright/<name>/secrets/<scope>/<secret>`; the scope defaults to
-   the repo of the cwd's `origin` remote.
+1. **Is the secret written?** `millwright secrets list [--scope <scope>]`
+   prints the secret names in a scope (`--all-scopes` for every scope; values
+   are never shown). The scope defaults to the repo of the cwd's `origin`
+   remote, the same default `secrets set` and the dispatch-time `Secret`
+   lookup use — if the name is missing, or sits under a different scope than
+   the workflow resolves against, write it with `millwright secrets set <name>
+   [--scope <scope>]`. Retire one with `millwright secrets rm <name>
+   [--scope <scope>]`.
 2. **Does the ref qualify?** `secretsAllowedRefs` is unset by default, which
    means *no ref receives secrets*. Patterns match the **short** ref name
    (`main`, `release/1.2`), anchored at both ends, with `*` as the only

okf-bundle/interfaces/cli.md

@@ -22,6 +22,8 @@ Setup & ops
   millwright doctor
   millwright refresh-host-keys
   millwright secrets set <name> [--scope <scope>]
+  millwright secrets list [--scope <scope>] [--all-scopes]
+  millwright secrets rm <name> [--scope <scope>]
 
 Definition
   millwright synth

package.json

@@ -1,6 +1,6 @@
 {
   "name": "millwright",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "private": true,
   "description": "Millwright monorepo — polling-driven CI/CD in your own AWS account",
   "license": "MIT",

packages/millwright-cdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@copperbox/millwright-cdk",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "The Millwright CDK construct — deploys the millwright control plane into your AWS account",
   "license": "MIT",
   "repository": {
@@ -23,9 +23,9 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@copperbox/millwright-cli": "^0.7.0",
-    "@copperbox/millwright-state": "^0.7.0",
-    "@copperbox/millwright-workflows": "^0.7.0",
+    "@copperbox/millwright-cli": "^0.8.0",
+    "@copperbox/millwright-state": "^0.8.0",
+    "@copperbox/millwright-workflows": "^0.8.0",
     "esbuild": "^0.28.0",
     "ssh2": "^1.17.0"
   },

packages/millwright-cdk/src/version.ts

@@ -1,5 +1,5 @@
 // Kept in lockstep with package.json by scripts/set-version.mjs — do not edit by hand.
-export const VERSION = '0.7.0';
+export const VERSION = '0.8.0';
 
 /**
  * Highest run-model schemaVersion this control plane accepts. Synth fails

packages/millwright-cli/README.md

@@ -151,6 +151,16 @@ as a SecureString under the deployment CMK. The scope defaults to the repo of
 the working directory's `origin` remote; secrets flow only to runs on refs
 matched by the repo's `secretsAllowedRefs`.
 
+`millwright secrets list [--scope <scope>]` prints the secret **names** in a
+scope, sorted — never their values; there is no way to read a value back
+through the CLI. `--all-scopes` enumerates every scope in the deployment
+instead, one `<scope>  <name>` line each.
+
+`millwright secrets rm <name> [--scope <scope>]` deletes one secret and
+reports the parameter path it removed; it fails with a non-zero exit when no
+such secret exists in that scope. Use it when a repo is offboarded or a secret
+is retired so the SecureString does not linger in the config plane.
+
 `millwright refresh-host-keys` re-pins GitHub's SSH host keys from the
 `/meta` endpoint — the manual hatch for confirmed key rotations. The poller
 honors the new pins on its next tick.

packages/millwright-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@copperbox/millwright-cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "millwright CLI — operate a millwright deployment from operator and developer machines",
   "license": "MIT",
   "repository": {
@@ -33,8 +33,8 @@
     "@aws-sdk/client-sfn": "^3.1108.0",
     "@aws-sdk/client-ssm": "^3.700.0",
     "@aws-sdk/lib-dynamodb": "^3.1108.0",
-    "@copperbox/millwright-state": "^0.7.0",
-    "@copperbox/millwright-workflows": "^0.7.0",
+    "@copperbox/millwright-state": "^0.8.0",
+    "@copperbox/millwright-workflows": "^0.8.0",
     "commander": "^12.1.0",
     "ssh2": "^1.17.0",
     "typescript": "^5.7.0"

packages/millwright-cli/src/cli.ts

@@ -14,7 +14,7 @@ import {
   RepoConfigFormatError,
   RunModelError,
 } from '@copperbox/millwright-state';
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 import { CommandError, requireManifestResource } from './config-plane';
 import { DefinitionLoadError } from './definition-loader';
 import { DEPLOYMENT_ENV_VAR, Deployment, DiscoveryError, discoverDeployment } from './discovery';
@@ -42,7 +42,7 @@ import {
   runsShow,
   runsShowLocal,
 } from './runs';
-import { secretsSet } from './secrets';
+import { secretsList, secretsRm, secretsSet } from './secrets';
 import { SetupDeps, refreshHostKeys, setup } from './setup';
 import { DEFAULT_ENTRY, runSynthCommand } from './synth-command';
 import { VERSION } from './version';
@@ -532,6 +532,38 @@ function buildProgramWithSignal(): { program: Command; exitCode: () => number }
       );
     });
 
+  secrets
+    .command('list')
+    .description('list secret names for a scope (never values)')
+    .option('--scope <scope>', 'secret scope; defaults to the repo of the cwd origin remote')
+    .addOption(
+      new Option('--all-scopes', 'list every scope in the deployment instead of one').conflicts(
+        'scope',
+      ),
+    )
+    .action(async (options: { scope?: string; allScopes?: boolean }) => {
+      await secretsList(
+        { ssm: new SSMClient({}), output },
+        {
+          scope: options.scope,
+          allScopes: options.allScopes === true,
+          explicitName: program.opts().deployment,
+        },
+      );
+    });
+
+  secrets
+    .command('rm')
+    .description('delete one workflow secret')
+    .argument('<name>', 'secret name as given to "secrets set"')
+    .option('--scope <scope>', 'secret scope; defaults to the repo of the cwd origin remote')
+    .action(async (name: string, options: { scope?: string }) => {
+      await secretsRm(
+        { ssm: new SSMClient({}), output },
+        { name, scope: options.scope, explicitName: program.opts().deployment },
+      );
+    });
+
   return { program, exitCode: () => signal.code };
 }
 

packages/millwright-cli/src/index.ts

@@ -153,7 +153,18 @@ export {
   DoctorReport,
   doctor,
 } from './doctor';
-export { SecretsDeps, SecretsSetOptions, parseGithubRemote, secretsSet } from './secrets';
+export {
+  SecretsDeps,
+  SecretsListEntry,
+  SecretsListOptions,
+  SecretsRmOptions,
+  SecretsScopeDeps,
+  SecretsSetOptions,
+  parseGithubRemote,
+  secretsList,
+  secretsRm,
+  secretsSet,
+} from './secrets';
 export {
   EventBridgeClientLike,
   RepoAddOptions,