fix(wfctl): support compute staging infra gaps#621
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends external plugin trigger support and introduces a sensitive-output routing helper to safely persist IaC outputs without leaking secrets (including generating GitHub Actions–compatible secret keys).
Changes:
- Add trigger-type dispatching to the external plugin gRPC server and shift remote trigger handle creation to
Configure(so config is available before creation). - Introduce
iac/sensitivehelpers to routeResourceOutputsensitive fields throughsecrets.Providerusing placeholders + sanitized secret keys, with regression tests. - Expand IaC provider interfaces/sentinel errors and load external plugin step schemas during
wfctl validate.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| plugin/external/sdk/grpc_server.go | Dispatch CreateModule to trigger providers and adapt trigger instances into module lifecycle RPCs. |
| plugin/external/sdk/grpc_server_test.go | Add coverage ensuring trigger provider types are created and started/stopped via module lifecycle. |
| plugin/external/remote_trigger.go | Delay remote trigger handle creation until Configure; add guardrails for unconfigured start/stop/destroy. |
| plugin/external/adapter.go | Update trigger factory to return an unconfigured RemoteTrigger (no early RPC handle creation). |
| plugin/external/adapter_test.go | Add test ensuring trigger creation is delayed until Configure. |
| interfaces/iac_resource_driver.go | Add new IaC sentinel errors (image missing; optional method unimplemented). |
| interfaces/iac_provider.go | Add optional EnumeratorAll interface for providers without tag support. |
| iac/sensitive/route.go | New package for routing sensitive outputs to secret providers and masking placeholders for state/diff. |
| iac/sensitive/route_test.go | Tests for GitHub-safe secret key generation and routing behavior. |
| cmd/wfctl/validate.go | Load external plugin step schemas when validating with --plugin-dir. |
intel352
force-pushed
the
codex/compute-wfctl-gaps
branch
from
a851625 to
39c27f8
Compare
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
Compute staging impact
This unblocks workflow-compute staging apply where DigitalOcean DB URI routing previously attempted to create invalid GitHub secret name
workflow-compute-staging-db_uri.