Skip to content

docs: add declarative manifest-plugins section to secrets management#45

Open
tanjadev wants to merge 1 commit into
mainfrom
docs/secrets-manifest-plugins
Open

docs: add declarative manifest-plugins section to secrets management#45
tanjadev wants to merge 1 commit into
mainfrom
docs/secrets-manifest-plugins

Conversation

@tanjadev

@tanjadev tanjadev commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds a new "Declarative secrets with manifest plugins" section to the secrets-management concept page, describing the upcoming [plugins] manifest section as a declarative alternative to hand-written on-activate retrieval hooks. Purely additive — the existing JIT/hook content is unchanged.

Content is based on:

  • the Forge secrets-management effort (ADR-001 reference-only JIT secrets, ADR-002 generic manifest plugin system)
  • the manifest-plugins-prototype branch in the flox repo (activation ordering, dev/build-only modes, plugin-owned table shape)

The section:

  • opens with an experimental-status note ([plugins] not yet in a stable manifest schema; older Flox versions reject it with an "unknown field" error)
  • uses the in-development 1Password plugin as the example: flox/1password in [install], then [plugins.1password] mapping env var names to op://vault/item/field references
  • covers key behavior: retrieval runs before on-activate (hooks and services see the vars), dev/build modes only, primary auth stays with the store
  • notes the manual hook pattern remains the path for stores without a plugin

Note

This page mints the canonical [plugins.1password] TOML example — no literal example exists in the effort docs or prototype. Worth confirming the op:// reference format (vs. bare paths) with the effort owner before the plugin ships.

Test plan

  • mint broken-links passes
  • Section renders between "Implementation examples" and "Rotating a secret"

🤖 Generated with Claude Code

Documents the upcoming [plugins] manifest section as an experimental,
declarative alternative to hand-written on-activate retrieval hooks,
using the in-development 1Password plugin as the example. Based on the
Forge secrets-management effort (ADR-001 reference-only JIT, ADR-002
generic plugin system) and the manifest-plugins-prototype branch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@mintlify

mintlify Bot commented Jul 22, 2026

Copy link
Copy Markdown

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated (UTC)
flox 🟢 Ready View Preview Jul 22, 2026, 3:39 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant