Checks & CI Secrets

CI reporting is keyed by commit sha: a run is the set of checks a commit reported. Runs start from files in the repo — a workflow under .github/workflows/ or a .dodil/checks.yaml — see Recipes — CI Checks.

List checks for a commit

GET /api/v1/repos/{repo_id}/checks?sha={sha}

{
  "checks": [
    {
      "check_id": "…", "sha": "9f2c41d…", "name": "ci/test",
      "state": "passed", "attempt": 1, "detail": "…",
      "details_url": "…", "created_at": "…", "updated_at": "…"
    }
  ],
  "rollup": "passed"
}

• state — queued → running → passed / failed / errored. A check is terminal (no further log output) in the last three.
• name — namespaced workflow/job.
• rollup — the worst-of state across all checks; "unspecified" means no checks reported for this sha. This same rollup surfaces as a PR’s checks_state and is what require_green_checks gates on.

Logs

Durable log — the full text for a finished run (or the live buffer while in flight). Plain text, not JSON:

curl -u "user:$DK_KEY" \
  https://git.dodil.io/api/v1/repos/{repo_id}/checks/{check_id}/logs

Live tail — an SSE stream (Accept: text/event-stream): the buffered head first, then each chunk as it lands, one data: line per frame. The stream closes when the run finishes:

curl -N -u "user:$DK_KEY" -H "Accept: text/event-stream" \
  https://git.dodil.io/api/v1/repos/{repo_id}/checks/{check_id}/logs/stream

Secrets referenced by the job are masked in both surfaces. Note for browser callers: EventSource can’t send an Authorization header — use fetch with a ReadableStream.

CI secrets (write-only)

Encrypted values injected into CI jobs — referenced by name from .dodil/checks.yaml, masked in logs. The model is deliberately write-only: a read returns names and timestamps, never values. Three independent scopes, merged at fetch time with precedence environment > repo > org:

Same three operations on each:

# list → {"secrets": [{name, created_at, updated_at}]}
GET    {base}
 
# create-or-replace a value (204 No Content)
PUT    {base}/{name}        # body: {"value": "…"}
 
# remove
DELETE {base}/{name}

Environment names are free-text (production, staging, …). Org secrets are inherited by every repo; a repo or environment secret with the same name wins at fetch time.

See also

• Core Concepts — CI checks — the model
• Recipes — CI Checks — push → run → gate a PR, end to end