feat: decorator for nominal contianers

[varun-nominal]

No description provided.

[greptile-apps]

Greptile Summary

Adds a new containerized_env_inputs decorator under nominal.experimental.containerized that auto-wires files, secrets, and parameters from specially-prefixed environment variables (__nominal_file_*, __nominal_secret_*, __nominal_parameter_*) into decorated function kwargs at runtime.

• New _decorators.py module with signature validation (_validate_param_in_signature) and env var collection (_collect_containerized_env_inputs)
• Decorator validates at decoration time that the wrapped function has correctly typed files: list, secrets: dict, and parameters: dict parameters
• Test coverage for injection, typing.List/Dict annotation compatibility, and validation error paths
• uv.lock version bump to 1.114.0

Confidence Score: 4/5

• This PR is safe to merge — it adds a new, well-tested experimental feature with no changes to existing code paths.
• Score reflects clean implementation with good test coverage and no changes to existing code. Deducted one point for the silent kwarg overwrite behavior which could cause subtle bugs for callers.
• nominal/experimental/containerized/_decorators.py — the wrapper silently overwrites caller-provided kwargs for files, secrets, and parameters.

Important Files Changed

Filename	Overview
nominal/experimental/containerized/_decorators.py	New decorator that auto-wires files, secrets, and parameters from environment variables into decorated function kwargs. Includes thorough signature validation. One style concern: caller-provided kwargs are silently overwritten.
nominal/experimental/containerized/init.py	Simple re-export of containerized_env_inputs from the private _decorators module. Clean and standard.
tests/test_containerized_env_inputs.py	Good test coverage: validates env var injection, typing.List/Dict annotation support, missing parameter detection, and wrong-type annotation detection.
uv.lock	Version bump from 1.113.0 to 1.114.0 in lockfile. No concerns.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["@containerized_env_inputs applied"] --> B["Validate signature: files: list, secrets: dict, parameters: dict"]
    B -->|Invalid| C["Raise TypeError"]
    B -->|Valid| D["Return wrapped function"]
    D --> E["Wrapped function called"]
    E --> F["Read os.environ for __nominal_file_*, __nominal_secret_*, __nominal_parameter_*"]
    F --> G["Inject files, secrets, parameters into kwargs"]
    G --> H["Call original function with injected kwargs"]

Loading

_{Last reviewed commit: 1e9c71e}

[greptile-apps]

_{5 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Submodule added without .gitmodules

This file is tracked as a git submodule (mode 160000), but there is no .gitmodules file in the repository to define the remote URL for nominal-containerized-env-inputs. Without .gitmodules, git submodule init and git clone --recurse-submodules will fail for anyone cloning the repo — the submodule reference will appear as an empty directory with no way to resolve the commit 9ead43b.

You need to either:

1. Add a .gitmodules file with the [submodule "nominal-containerized-env-inputs"] section specifying the path and url, or
2. If this was unintentionally committed (e.g., a nested git repo), remove the submodule entry and add the path to .gitignore.

Prompt To Fix With AI

This is a comment left during a code review.
Path: nominal-containerized-env-inputs
Line: 1

Comment:
**Submodule added without `.gitmodules`**

This file is tracked as a git submodule (mode `160000`), but there is no `.gitmodules` file in the repository to define the remote URL for `nominal-containerized-env-inputs`. Without `.gitmodules`, `git submodule init` and `git clone --recurse-submodules` will fail for anyone cloning the repo — the submodule reference will appear as an empty directory with no way to resolve the commit `9ead43b`.

You need to either:
1. Add a `.gitmodules` file with the `[submodule "nominal-containerized-env-inputs"]` section specifying the `path` and `url`, or
2. If this was unintentionally committed (e.g., a nested git repo), remove the submodule entry and add the path to `.gitignore`.

How can I resolve this? If you propose a fix, please make it concise.