feat(generate): S6 (part) — secret:// env values become valueless keys - #41
Merged
Conversation
…s (spec 04 §7.5) Close a real leak: a `secret://` reference in env.raw/env.prefixed was previously emitted into the generated compose as its literal value (the ref string). Now projectEnv detects a secret:// value and emits a VALUELESS key (null) — exactly like the existing import-secretAttrs coupling — so neither the ref nor (later) its resolved value ever lands in a generated file. The runtime value is injected via the compose-up process env (the saga's secrets phase, the remaining S6 half: collect refs → batched Resolve → Compose.Env). Non-secret env values are still interpolated + emitted verbatim. Golden + determinism unchanged (the fixture uses import-secretAttrs, not secret:// env). Leak test: a secret:// env.raw value yields `DB_PASSWORD: null` with no `secret://` anywhere in the output; a sibling plain value survives. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chunk S6 (part) — close the secret:// env leak
A
secret://ref inenv.raw/env.prefixedwas being written into the generated compose as its literal value (the ref string). NowprojectEnvdetects it and emits a valueless key (DB_PASSWORD: null) — same coupling as the existing import-secretAttrs path — so neither the ref nor (later) its resolved value reaches a generated file. The runtime value is injected via the compose-up process env (the saga secrets phase = the remaining S6 half: collect → batched Resolve →Compose.Env).Non-secret env values are still interpolated + emitted verbatim. Golden + determinism unchanged.
Test
A
secret://env.raw value →DB_PASSWORD: null, nosecret://anywhere in the output; a sibling plain value survives.Gate
make ci+make determinismgreen.🤖 Generated with Claude Code