feat(wfctl): infra audit-secrets command (PR0: Tasks 1+2)#581
Merged
Conversation
Adds TestInfraAuditSecrets_TwoEntryAntiPattern and TestInfraAuditSecrets_CanonicalShape_Passes covering Task 1 of plan docs/plans/2026-05-08-spaces-key-iac-resource.md. Test currently fails with `undefined: runInfraAuditSecrets`. Task 2 implements the command to make these pass. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds the initial TDD scaffolding for a new wfctl infra audit-secrets command intended to audit secrets.generate entries for known anti-patterns (notably the two-entry provider_credential pattern for Spaces credentials).
Changes:
- Added failing unit tests that define expected behavior for detecting the two-entry
provider_credentialanti-pattern and accepting the canonical single-key shape. - Added a YAML fixture under
cmd/wfctl/testdata/audit-secrets/representing the anti-pattern config.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| cmd/wfctl/infra_audit_secrets_test.go | Adds TDD tests asserting non-zero exit and output content for the anti-pattern vs. zero exit for canonical shape. |
| cmd/wfctl/testdata/audit-secrets/two-entry-bad.yaml | Adds a fixture YAML representing the two-entry provider_credential anti-pattern. |
Comment on lines
+27
to
+34
| var out bytes.Buffer | ||
| exitCode := runInfraAuditSecrets([]string{"-c", cfg}, &out) | ||
| if exitCode == 0 { | ||
| t.Fatalf("expected non-zero exit on anti-pattern; got 0\nout=%s", out.String()) | ||
| } | ||
| if !bytes.Contains(out.Bytes(), []byte("two-entry provider_credential")) { | ||
| t.Errorf("expected 'two-entry provider_credential' in output; got: %s", out.String()) | ||
| } |
Comment on lines
+26
to
+31
|
|
||
| var out bytes.Buffer | ||
| exitCode := runInfraAuditSecrets([]string{"-c", cfg}, &out) | ||
| if exitCode == 0 { | ||
| t.Fatalf("expected non-zero exit on anti-pattern; got 0\nout=%s", out.String()) | ||
| } |
Comment on lines
+11
to
+25
| tmp := t.TempDir() | ||
| cfg := filepath.Join(tmp, "infra.yaml") | ||
| if err := os.WriteFile(cfg, []byte(`secrets: | ||
| generate: | ||
| - key: SPACES_access_key | ||
| type: provider_credential | ||
| source: digitalocean.spaces | ||
| name: test-key | ||
| - key: SPACES_secret_key | ||
| type: provider_credential | ||
| source: digitalocean.spaces | ||
| name: test-key | ||
| `), 0644); err != nil { | ||
| t.Fatal(err) | ||
| } |
Comment on lines
+1
to
+10
| secrets: | ||
| generate: | ||
| - key: SPACES_access_key | ||
| type: provider_credential | ||
| source: digitalocean.spaces | ||
| name: test-key | ||
| - key: SPACES_secret_key | ||
| type: provider_credential | ||
| source: digitalocean.spaces | ||
| name: test-key |
…terns Implements `wfctl infra audit-secrets` per Task 2 of plan docs/plans/2026-05-08-spaces-key-iac-resource.md (commit 316559f7). The command reads `secrets.generate` from infra.yaml (or path passed via -c/--config) and reports three anti-patterns, exiting non-zero on any finding so CI can block bad configs before plan/apply: 1. Two-entry provider_credential — keys ending in `_access_key` / `_secret_key` with type=provider_credential. Canonical shape uses a single bundle key (e.g. SPACES); the bootstrap layer auto-derives sub-keys from providerCredentialSubKeys. 2. Duplicate provider_credential `name` across multiple entries — each such entry creates a separate cloud resource (the doubled-create symptom that motivated this audit). 3. Unknown provider_credential `source` — workflow doesn't know how to derive sub-keys; likely a stale config or version mismatch. Registered under the `infra` subcommand group in cmd/wfctl/infra.go. Failing tests from the previous commit now PASS: GOWORK=off go test ./cmd/wfctl -run TestInfraAuditSecrets -v Representative invocation against the bad fixture exits 1 with three FINDING lines as expected. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
wfctl infra audit-secrets(cmd/wfctl/infra_audit_secrets_test.go+ fixture undercmd/wfctl/testdata/audit-secrets/).runInfraAuditSecretsthat detects two-entry provider_credential / duplicate names / unknown sources, plus subcommand registration inmain.go.Plan ref:
docs/plans/2026-05-08-spaces-key-iac-resource.md(commit 316559f7), Tasks 1–2.Test plan
GOWORK=off go test ./cmd/wfctl -run TestInfraAuditSecrets -vcurrently FAILS withundefined: runInfraAuditSecrets(TDD Step 2 expectation)./wfctl infra audit-secrets --helpprints usage./wfctl infra audit-secrets -c testdata/audit-secrets/two-entry-bad.yamlexits non-zero withtwo-entry provider_credentialfinding🤖 Generated with Claude Code