AUT-11295 Manage workspace secrets via dedicated secrets pipeline - #50
Draft
piotrek-janus wants to merge 8 commits into
Draft
piotrek-janus wants to merge 8 commits into
piotrek-janus wants to merge 8 commits into
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Unresolved critical and moderate issues can break secret pushes, API requests, output handling, and collision-safe storage.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (3)
What changed in this PR
Adds config-as-code workspace-secret management using environment-backed YAML stubs and dedicated Secrets APIs.
Changes:
- Adds secret planning, filesystem storage, and API reconciliation.
- Adds
--workspace-secretssupport to pull, push, and diff. - Adds documentation, unit tests, and mock API coverage.
Review findings:
- Moderate (1 vote):
cmd/diff.go:57reports both--sourceand--targetas missing when only one is unset. - Moderate (1 vote):
cmd/push.go:165ignores--outduring secrets dry runs. - Moderate (1 vote):
internal/cac/client/secrets_api.go:44omits requiredtenant_idfrom create requests. - Moderate (1 vote):
internal/cac/client/secrets_api.go:54omits requiredtenant_idfrom update requests. - Moderate (2 votes):
internal/cac/secrets/dir_store.go:148-149checks normalized paths rather than IDs, causing shadowing and filename collisions. - Critical (2 votes):
internal/cac/secrets/dir_store.go:71,74,151,158,160renders lower-precedence duplicates before skipping them, allowing irrelevant missing environment variables to fail pushes. - Moderate (1 vote):
internal/cac/secrets/dir_store.go:158generates colliding environment-variable names for distinct secret IDs. - Moderate (3 votes):
internal/cac/secrets/secrets.go:102uses a lossy environment-variable mapping that aliases distinct IDs. - Moderate (1 vote):
internal/cac/secrets/secrets.go:94normalizes distinct IDs to identical filenames, preventing all stubs from being created.
| File | Description |
|---|---|
README.md |
Documents workspace-secret workflows. |
internal/cac/secrets/secrets.go |
Defines secret models, plans, and naming helpers. |
internal/cac/secrets/secrets_test.go |
Tests planning and naming behavior. |
internal/cac/secrets/dir_store.go |
Reads definitions and writes secret stubs. |
internal/cac/secrets/dir_store_test.go |
Tests directory storage behavior. |
internal/cac/client/secrets_api.go |
Implements Secrets API operations. |
internal/cac/client/secrets_api_test.go |
Tests Secrets API integration. |
internal/cac/client/mock_server_test.go |
Adds mock secret endpoints. |
internal/cac/app.go |
Exposes the Secrets API store. |
cmd/root.go |
Adds the workspace-secrets flag. |
cmd/push.go |
Implements secret reconciliation, pruning, and dry runs. |
cmd/pull.go |
Implements secret stub generation. |
cmd/flags.go |
Removes the obsolete required-flag helper. |
cmd/diff.go |
Implements secret ID comparison. |
cmd/diff_secrets_test.go |
Tests secret diff reporting. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+71
to
+74
| err := d.walk(wid, func(path string) error { | ||
| var s Secret | ||
|
|
||
| bts, err := templates.New(path).Render() |
Comment on lines
+148
to
+153
| for _, id := range ids { | ||
| file := filepath.Join(path, NormalizeFileName(id)+".yaml") | ||
|
|
||
| if _, err = os.Stat(file); err == nil { | ||
| skipped = append(skipped, id) | ||
| continue |
Comment on lines
+102
to
+103
| func EnvVarName(id string) string { | ||
| return "CAC_SECRET_" + nonEnv.ReplaceAllString(strings.ToUpper(id), "_") |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira task - https://secureauth.atlassian.net/browse/AUT-11295
Release Notes Description (public)
Manage workspace secrets as config-as-code using the dedicated secret system APIs. New
--workspace-secrets <workspace>flag onpull,push, anddiffoperates exclusively on secrets:pullscaffolds env-injected stub files,pushreconciles remote secrets from local definitions (create/update, delete with--prune), anddiffcompares local definitions against the remote workspace. Secret values are never stored in the repository — each secret file references an environment variable resolved at push time.Implementation details (internal)
Alternative to #30 (same Jira). Instead of threading a
Patch/Extenvelope through everySource/Storage/Validator/diffsignature, secrets get a self-contained vertical slice; the existing config pipeline is untouched.internal/cac/secrets: local model, pure plan computation (ComputePlan→ create/update/delete sets), andDirStoreforworkspaces/<wid>/secrets/*.yaml.ListIDsreads raw YAML (no env vars needed, used by pull/diff);Listrenders{{ env }}templates and rejects empty values before any API call (used by push).internal/cac/client/secrets_api.go:SecretsAPIStoreover the system Secrets CRUD API.value: '{{ env "CAC_SECRET_<ID>" }}'— single-quoted so files parse as plain YAML while remaining valid Go templates.pullnever overwrites existing secret files.--workspace-secretsis mutually exclusive with--workspace/--tenant/--filter;push --methodanddiff --source/--targetare validated in RunE so they stay required for config mode only.push --dry-runprints exactly the plan a real push would apply.Information for QA
Additional QA Procedures (Optional)
Suggested manual flow against a dev tenant:
pull --workspace-secrets <wid>(stubs created, re-run skips), setCAC_SECRET_*env vars,push --workspace-secrets <wid> --dry-run(plan lists IDs only), real push,diff --workspace-secrets <wid>, andpush --pruneafter deleting a local file.