From dc9975d0a4fef8912341585fb83ca7fd6e28f8b1 Mon Sep 17 00:00:00 2001
From: Dov Benyomin Sohacheski <b@kloud.email>
Date: Thu, 8 Jan 2026 12:52:59 +0200
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=94=90=20Add=20secret=20subcommand?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/ci.yaml |  2 +-
 docs/tools/ws-cli.md      | 29 +++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 454685d..8cb4bae 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -64,7 +64,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: 🔽 Download Artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: build
           path: .vitepress/dist
diff --git a/docs/tools/ws-cli.md b/docs/tools/ws-cli.md
index 3b2f3dc..a6564b2 100644
--- a/docs/tools/ws-cli.md
+++ b/docs/tools/ws-cli.md
@@ -43,6 +43,7 @@ ws clip paste | grep "pattern"
 
 ::: tip
 For quick clipboard access, use the clipboard binaries:
+
 ```sh
 # macOS-compatible
 echo "copy this" | pbcopy
@@ -56,6 +57,7 @@ xclip -o -sel c
 echo "copy this" | xsel -b
 xsel -b -o
 ```
+
 :::
 
 See the [Terminal Clipboard](/editor/terminal#clipboard) section for more details.
@@ -100,6 +102,33 @@ Retrieve workspace logs.
 ws logs --level=error --tail=100 --follow
 ```
 
+### Secrets (`ws secrets`)
+
+Manage encryption, decryption, and master key generation for secure secrets handling.
+
+- **`generate`:** Generate a cryptographically secure master key.
+- **`encrypt <plaintext>`:** Encrypt a plaintext value using a master key.
+- **`decrypt <encrypted>`:** Decrypt an encrypted value using a master key.
+
+#### Flags
+
+- **`--master <key>`:** Master key or path to key file.
+- **`--mode <permissions>`:** File permissions *(e.g., 0o600, 384)*, only when `--output`
+    is used. Values can be decimal or octet.
+- **`--force`:** Overwrite existing files.
+- **`--raw`:** Output without styling.
+
+```sh
+# Generate a master key
+ws secrets generate --output .master.key --mode 0o600
+
+# Encrypt a value
+ws secrets encrypt "my-secret-value" --master .master.key
+
+# Decrypt a value
+ws secrets decrypt "base64:TWFueSBoYW5kcyBtYWtlIGxpZ2h0IHdvcmsu..." --master .master.key
+```
+
 ### Serve (`ws serve`)
 
 Serve internal assets.

From 4b162d357c1a861bd107993057e12a75f58a3b5a Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 8 Jan 2026 10:53:49 +0000
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=94=BC=20Bump=20actions/download-arti?=
 =?UTF-8?q?fact=20action=20to=20v7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 8cb4bae..a90ceb4 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -112,7 +112,7 @@ jobs:
 
     steps:
       - name: 🔽 Download Artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           path: build
           merge-multiple: true