feat(wfctl): route infra output secrets#711
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for routing infra_output secret generators to specific named secret stores and enables the GitHub secrets provider to target GitHub Actions environment-scoped secrets, so wfctl infra apply can pipe provisioning outputs (e.g. a database URL) directly into a per-environment secret destination.
Changes:
- Extend
GitHubSecretsProviderwithSetEnvironment/Environmentand centralized URL builders that switch between repo-level and environment-scoped Actions secret endpoints. - Add
SecretGen.Storefield and wiresyncInfraOutputSecretsto resolve a per-generator provider fromsecretStores, with${WORKFLOW_ENV}expansion in store config. - Update docs (
docs/dsl-reference.md, embedded copy), CHANGELOG, and add tests covering environment scoping and store routing.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| secrets/github_provider.go | Adds environment scope state and URL builders for Actions environment secret endpoints |
| secrets/github_provider_test.go | Verifies environment-scoped endpoints for Set/List/public-key |
| config/secrets_config.go | Adds Store field on SecretGen |
| config/secrets_multistore_test.go | Asserts generate[].store round-trips through config |
| cmd/wfctl/infra.go | Loads workflow config when any infra_output generator has env or store set |
| cmd/wfctl/infra_secrets.go | Adds resolveSecretsProviderForEnv, WORKFLOW_ENV expansion, github environment wiring, and secretsConfigFromStore helper |
| cmd/wfctl/infra_secrets_test.go | Covers env-scoped GitHub provider resolution |
| cmd/wfctl/infra_output_secrets.go | Per-generator provider resolution + per-provider list cache refactor |
| cmd/wfctl/infra_output_secrets_test.go | Asserts routing to a named store bypasses fallback provider |
| docs/dsl-reference.md, cmd/wfctl/dsl-reference-embedded.md | Documents github provider config and generate[].store |
| CHANGELOG.md | Notes the two new capabilities |
Comment on lines
+149
to
+165
| listLookups := map[secrets.Provider]*providerListLookup{} | ||
|
|
||
| stateOutputs := buildStateOutputsMap(states) | ||
|
|
||
| for _, gen := range gens { | ||
| genProvider, err := providerForSecretGen(wfCfg, provider, gen, envName) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| lookupViaList := func(key string) (bool, error) { | ||
| lookup, ok := listLookups[genProvider] | ||
| if !ok { | ||
| lookup = &providerListLookup{provider: genProvider} | ||
| listLookups[genProvider] = lookup | ||
| } | ||
| return lookup.exists(ctx, key) | ||
| } |
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification