Merge pull request #1509 from talentedmrjones/europa-secrets-wrappers

Implements #DecodeSecret as a wrapper to #TransformSecret

pkg/dagger.io/dagger/utils.cue

@@ -1,6 +1,8 @@
 package dagger
 
 import (
+	"encoding/yaml"
+	"encoding/json"
 	"dagger.io/dagger/engine"
 )
 
@@ -17,7 +19,7 @@ import (
 // Select a subdirectory from a filesystem tree
 #Subdir: {
 	// Input tree
-	input: #FS
+	input: engine.#FS
 
 	// Path of the subdirectory
 	// Example: "/build"
@@ -32,5 +34,27 @@ import (
 	}
 
 	// Subdirectory tree
-	output: #FS & _copy.output
+	output: engine.#FS & _copy.output
+}
+
+// DecodeSecret is a convenience wrapper around #TransformSecret. The plain text contents of input is expected to match the format
+#DecodeSecret: {
+	{
+		format: "json"
+		engine.#TransformSecret & {
+			#function: {
+				input:  _
+				output: json.Unmarshal(input)
+			}
+		}
+	} | {
+		format: "yaml"
+		engine.#TransformSecret & {
+			#function: {
+				input:  _
+				output: yaml.Unmarshal(input)
+			}
+		}
+	}
+
 }

tests/tasks/dockerfile/build_auth.cue

@@ -1,8 +1,8 @@
 package testing
 
 import (
+	"dagger.io/dagger"
 	"dagger.io/dagger/engine"
-	"encoding/yaml"
 )
 
 engine.#Plan & {
@@ -15,21 +15,18 @@ engine.#Plan & {
 	}
 
 	actions: {
-		dockerHubToken: engine.#TransformSecret & {
+		sopsSecrets: dagger.#DecodeSecret & {
+			format: "yaml"
 			input:  inputs.secrets.sops.contents
-			#function: {
-				input:  _
-				output: yaml.Unmarshal(input)
-			}
 		}
 
-		build: engine.#Build & {
+		build: engine.#Dockerfile & {
 			source: inputs.directories.testdata.contents
 			auth: [{
 				target:   "daggerio/ci-test:private-pull"
 				username: "daggertest"
 
-				secret: dockerHubToken.output.DOCKERHUB_TOKEN.contents
+				secret: sopsSecrets.output.DOCKERHUB_TOKEN.contents
 			}]
 			dockerfile: contents: """
 				FROM daggerio/ci-test:private-pull@sha256:c74f1b1166784193ea6c8f9440263b9be6cae07dfe35e32a5df7a31358ac2060

tests/tasks/gitpull/private_repo.cue

@@ -1,7 +1,7 @@
 package main
 
 import (
-	"encoding/yaml"
+	"dagger.io/dagger"
 	"dagger.io/dagger/engine"
 )
 
@@ -17,12 +17,9 @@ engine.#Plan & {
 			source: "alpine:3.15.0"
 		}
 
-		repoPassword: engine.#TransformSecret & {
+		sopsSecrets: dagger.#DecodeSecret & {
+			format: "yaml"
 			input:  inputs.secrets.sops.contents
-			#function: {
-				input:  _
-				output: yaml.Unmarshal(input)
-			}
 		}
 
 		testRepo: engine.#GitPull & {
@@ -30,7 +27,7 @@ engine.#Plan & {
 			ref:    "main"
 			auth: {
 				username: "dagger-test"
-				password: repoPassword.output.TestPAT.contents
+				password: sopsSecrets.output.TestPAT.contents
 			}
 		}
 

tests/tasks/pull/pull_auth.cue

@@ -1,20 +1,28 @@
 package main
 
 import (
+	"dagger.io/dagger"
 	"dagger.io/dagger/engine"
 )
 
 engine.#Plan & {
-	inputs: secrets: dockerHubToken: command: {
+	inputs: secrets: sops: command: {
 		name: "sops"
-		args: ["exec-env", "../../secrets_sops.yaml", "echo $DOCKERHUB_TOKEN"]
+		args: ["-d", "../../secrets_sops.yaml"]
 	}
-	actions: pull: engine.#Pull & {
+
+	actions: {
+		sopsSecrets: dagger.#DecodeSecret & {
+			format: "yaml"
+			input:  inputs.secrets.sops.contents
+		}
+
+		pull: engine.#Pull & {
 			source: "daggerio/ci-test:private-pull@sha256:c74f1b1166784193ea6c8f9440263b9be6cae07dfe35e32a5df7a31358ac2060"
 			auth: [{
 				target:   "daggerio/ci-test:private-pull"
 				username: "daggertest"
-			secret:   inputs.secrets.dockerHubToken.contents
+				secret:   sopsSecrets.output.DOCKERHUB_TOKEN.contents
 			}]
 		} & {
 			// assert result
@@ -24,4 +32,5 @@ engine.#Plan & {
 				cmd: ["/bin/sh"]
 			}
 		}
+	}
 }

tests/tasks/push/push.cue

@@ -2,22 +2,29 @@ package main
 
 import (
 	"strings"
+	"dagger.io/dagger"
 	"dagger.io/dagger/engine"
 )
 
 engine.#Plan & {
-	inputs: secrets: dockerHubToken: command: {
+	inputs: secrets: sops: command: {
 		name: "sops"
-		args: ["exec-env", "../../secrets_sops.yaml", "echo $DOCKERHUB_TOKEN"]
+		args: ["-d", "../../secrets_sops.yaml"]
 	}
 
 	#auth: [{
 		target:   "daggerio/ci-test:private-pull"
 		username: "daggertest"
-		secret:   inputs.secrets.dockerHubToken.contents
+		secret:   actions.sopsSecrets.output.DOCKERHUB_TOKEN.contents
 	}]
 
 	actions: {
+
+		sopsSecrets: dagger.#DecodeSecret & {
+			format: "yaml"
+			input:  inputs.secrets.sops.contents
+		}
+
 		randomString: {
 			baseImage: engine.#Pull & {
 				source: "alpine:3.15.0@sha256:e7d88de73db3d3fd9b2d63aa7f447a10fd0220b7cbf39803c803f2af9ba256b3"