Create a secret
create_secretCreate a secret at repository, organization, or global scope for Woodpecker CI. Specify events like push or pull_request; without an event, the secret stays invisible to builds.
Instructions
Creates a secret at the chosen level. The value is write-only: it is never readable again through the API, so store it somewhere else too. At least one event is required — the API has no defaults, and a secret without pull_request is invisible to pull-request builds.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Secret name, stored case-sensitively — MY_TOKEN and my_token are two secrets. | |
| note | No | Free-text note shown next to the secret in the web UI. | |
| scope | Yes | Which level to act on. "repository" needs repo_id, "organization" needs org_id, and "global" is instance-wide and needs neither (admin only). A pipeline sees the repository level first, then the organization, then global. | |
| value | Yes | The secret value. Write-only — it cannot be read back. | |
| events | Yes | Events this applies to. The API has no defaults — at least one is required. A secret that should reach pull-request builds has to name pull_request explicitly; "push", "tag" and "manual" are what the web UI preselects. | |
| images | No | Restrict the secret to these container images. An empty list — the default — means every image may read it. | |
| org_id | No | Required when scope is "organization". | |
| repo_id | No | Required when scope is "repository". |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| truncated | No | Present only when the answer was shortened to fit the budget. |