Closes#32
Connection strings passed as argv (user/password@service) are visible
to other users via ps and /proc, recorded in shell history, and
captured by terminal scrollback and CI job log retention. Restructure
the SQLcl basics and CI/CD skills so the primary examples never put
a password on the command line.
sqlcl-basics.md
- Lead the Connecting section with a security warning and replace the
first credentialed examples with prompted-password forms.
- Replace the literal admin/MyPassword123@myadb_high example.
- Add a Discouraged: Passwords on the Command Line subsection that
enumerates the leak surfaces.
- Link SEPS as the password-less option from the Cloud Wallet section.
sqlcl-cicd.md
- Replace sql -S user/pass@service patterns with sql -S /nolog plus
a CONNECT issued from stdin via heredoc, so credentials reach SQLcl
on fd 0 rather than as process arguments. Document SEPS (/@alias)
as the password-less alternative.
- Update the GitHub Actions and GitLab CI examples to inject masked
CI secrets through the step env: block and the heredoc.
- Add a Keep Credentials Out of the Command Line section with side-
by-side SEPS, /nolog, and avoid examples, and a warning against
set -x in steps that handle the stdin connect.
- Add Oracle Database Security Guide, GitHub Actions secrets, and
GitLab CI variables references to Sources.
Signed-off-by: Gustavo Evangelista <gustavoborges2@gmail.com>
New skill files:
- sqlcl-scheduler-daemon.md: SQLcl daemon lifecycle (start/stop/restart/status),
scheduler.yaml YAML format, Quartz 7-field cron syntax with examples, payload
types (inline SQL, PL/SQL blocks, script files with args), live reload, log file
structure (scheduler.log, jobs.log, per-job logs), systemd integration
- sqlcl-awr.md: awr list snapshots, awr create snapshot (flush levels: bestfit/
lite/typical/all), awr create html/text with and without explicit snapshot IDs,
bracket-a-workload pattern, key AWR report sections to interpret, daemon scheduling
- sqlcl-background-jobs.md: background/bg command, jobs/jb subcommands (list, logs,
cancel, delete -finished/-all), wait4/w4 with -delay, task dependency chaining
via -wait4, parallel execution patterns, job status reference
Updates to sqlcl-mcp-server.md:
- Added direct download permalink: https://download.oracle.com/otn_software/java/sqldeveloper/sqlcl-latest.zip
- Added manual install steps from zip (macOS/Linux) and Windows winget upgrade path
- Added multiple connections explanation
- Added Common Use Cases section: natural language queries, schema exploration,
report generation, query tuning, schema changes, DDL extraction, data loading,
formatted output/export, Liquibase operations, JavaScript automation
- Added three Oracle-documented MCP use cases: transaction review before commit,
multi-environment comparison, performance monitoring with optimization advice
- Added Limitations table (transport, single connection, result set size, etc.)
- Expanded Common Mistakes into full Troubleshooting section with subsections for
MCP server not appearing, connection failures, missing log table, Java not found,
non-ASCII encoding (JAVA_TOOL_OPTIONS)
- Updated Related Skills to cover all sqlcl/*.md files plus new skill files
Updates to sqlcl-basics.md:
- Added ARGUMENT command: named typed script parameters vs positional &1/&2,
type declaration, description string, call syntax
- Added STARTUP/SHUTDOWN: all modes with descriptions (NOMOUNT, MOUNT, OPEN,
FORCE, RESTRICT, READ ONLY; NORMAL, IMMEDIATE, TRANSACTIONAL, ABORT),
local OS auth pattern for headless startup
Updates to db/SKILL.md:
- Updated sqlcl/ row to include scheduler daemon, AWR, background jobs
- Added MCP multi-step flow: sqlcl-basics → privilege-management → sqlcl-mcp-server
Kris Rice