feat(wfctl): secrets provider metadata + access + adapter unification + list upgrade (PR1/7)#799
Merged
Merged
Conversation
…er supports all backends
… unsupported env store (no prefix) returns ErrUnsupported from StatAll; Check now resolves StatAll -> Get-presence -> List-membership in precedence order so env/file/vault/aws use Get and write-only github uses List. Fixes TestBuildSecretStatuses_Basic/_MultiStore. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…error; harden tests Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| if err != nil { | ||
| return fmt.Errorf("secrets: file store not accessible: %w", err) | ||
| } | ||
| f.Close() |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
PR1 of the wfctl secrets wizard + smart CI generation cascade (design+plan:
workspace:docs/plans/2026-05-30-wfctl-secrets-wizard-and-smart-ci{-design,}.md, adversarial PASS, scope-locked). Foundation for the interactive/non-interactive secrets wizard (PR2) — no behavior change to existing flows; all additive.Tasks (1–5)
secrets/secrets.go):SecretMeta, optionalMetadataProvider(StatAll), optionalAccessChecker(CheckAccess). Additive —secrets.Providerunchanged.StatAllreturns realcreated_at/updated_at(expanded the list decode);CheckAccessvia GET public-key. Errors are redacted (no token in messages).StatAll/CheckAccess(file uses mtime; env presence-only); vault/aws best-effort (ErrUnsupportedfallback — no live-cred dependency in unit tests).secretsProviderAdapterwrapssecrets.Providerto satisfy the wfctl-localSecretsProvider.newSecretsProviderrepurposed to build viaresolveSecretsProvider+ adapter (now supports github/vault/aws/env/keychain — previously env-only); signature unchanged so all 7 call sites are untouched.getProviderForStorererouted. (ADR 0005.)secrets list:UPDATEDcolumn (from metadata;—when unknown),--jsonoutput for agents, per-store access line;runSecretsInitmessage reflects the resolved provider.Adapter resolution precedence
Check:StatAll(authoritative on success) →Get-presence (env/file/vault/aws) →List-membership (write-only github). This precedence fix resolved a regression where env-store secrets reported unset.Verification
GOWORK=off go test ./secrets/ ./cmd/wfctl/→ bothok.GOWORK=off golangci-lint run ./secrets/... ./cmd/wfctl/...→0 issues.Notes
TestFallbackRuns(ci_run_test.go) is a pre-existing meta-test (asserts an inner subprocess fails) — untouched by this PR.🤖 Generated with Claude Code