mise

Tie a repository to a rolle session with mise.

mise sets environment variables per directory and runs hooks when you enter one. With rolle’s profiles and rolle env, a cd into a repository selects the role.

The examples use session names from rolle session list: Acme Prod/AdministratorAccess (Identity Center role), Contoso Production (Azure subscription), my-project (Google Cloud project).

AWS

An AWS session is a profile backed by credential_process. The directory names the profile. No credential enters the file.

[env]
AWS_PROFILE = "acme-prod"

[hooks]
enter = "rolle start 'Acme Prod/AdministratorAccess'"

AWS_PROFILE is the session’s profile: the Profile column in the app and in rolle session list. The hook takes the session name. It starts the session when you enter the directory, and signs in first when the portal token is expired. Every AWS tool in that shell reads the profile and fetches credentials through rolle.

Azure and Google Cloud

Azure and Google Cloud sessions export short-lived tokens. rolle token prints one. A template puts it in a variable. Later entries copy the first, so rolle runs once. redactions keeps the token out of mise env output and logs.

redactions = ["CLOUDSDK_AUTH_ACCESS_TOKEN", "GOOGLE_OAUTH_ACCESS_TOKEN"]

[env]
CLOUDSDK_CORE_PROJECT = "my-project"
CLOUDSDK_AUTH_ACCESS_TOKEN = "{{ exec(command='rolle token my-project') }}"
GOOGLE_OAUTH_ACCESS_TOKEN = "{{ env.CLOUDSDK_AUTH_ACCESS_TOKEN }}"

mise runs the command each time it builds the directory’s environment. rolle answers from its credential cache. No token enters mise’s cache. When the session needs a sign-in, the command exits with code 3 and names the command to run.

To export every variable of a session, source a script:

redactions = ["AZURE_ACCESS_TOKEN", "CLOUDSDK_AUTH_ACCESS_TOKEN", "GOOGLE_OAUTH_ACCESS_TOKEN"]

[env]
_.source = ".rolle.sh"

# .rolle.sh
eval "$(rolle env 'Contoso Production')"

rolle env prints the token and the tenant, subscription, or project.

One variable at a time

A template fetches one value and caches it:

[env]
AWS_ACCOUNT_ID = """{{ exec(command="rolle session list --json | jq -r '.[] | select(.name == \"Acme Prod/AdministratorAccess\") | .accountId'", cache_duration="1h") }}"""

Notes

• rolle start on an active session reports the session and its expiry and changes nothing.
• The CLI and the app share one workspace. The desktop app shows the session as active when the hook starts it.
• Commit mise.toml and .rolle.sh. Neither holds a secret. Team members with the same session names get the same setup.