Skip to content

feat: Using secrets in expressions#2899

Open
shiroyasha wants to merge 21 commits intomainfrom
secrets-in-expr
Open

feat: Using secrets in expressions#2899
shiroyasha wants to merge 21 commits intomainfrom
secrets-in-expr

Conversation

@shiroyasha
Copy link
Collaborator

No description provided.

Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
tx *gorm.DB,
encryptor crypto.Encryptor,
orgID uuid.UUID,
) (any, error) {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this different than the regular one? Why?

Signed-off-by: Igor Šarčević <igor@operately.com>
@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Feb 6, 2026

Deploying superplane with  Cloudflare Pages  Cloudflare Pages

Latest commit: 2987d65
Status: ✅  Deploy successful!
Preview URL: https://a86473a5.superplane.pages.dev
Branch Preview URL: https://secrets-in-expr.superplane.pages.dev

View logs

resolved, err := w.resolveConfigAtRuntime(tx, execution, node, inputEvent, input, workflow)
if err != nil {
logger.Errorf("failed to resolve configuration at runtime: %v", err)
return execution.FailInTransaction(tx, models.CanvasNodeExecutionResultReasonError, fmt.Sprintf("configuration resolution failed: %v", err))
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we simply return the error here?

inputEvent *models.CanvasEvent,
input any,
workflow *models.Canvas,
) (map[string]any, error) {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The number of args here is worrying.


configuration := map[string]any{
"api_key": `{{ secrets("my-secret").token }}`,
"mixed": `prefix {{ secrets("other").key }} suffix`,
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need a test where secrets are transformed with a function.

func resolveRuntimeValue(value any, resolveString func(string) (any, error)) (any, error) {
switch v := value.(type) {
case string:
if strings.Contains(v, "{{") && strings.Contains(v, "}}") {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not ok, it should use the same check as the non-runtime, but negated.

Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
tree, err := parser.Parse(expression)

if err != nil {
// If parsing fails, fall back to a string check to ensure malformed expressions are still deferred.
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Questionable if this is needed.

Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Signed-off-by: Igor Šarčević <igor@operately.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant