Merge pull request from GHSA-69p4-j5v5-x234

* fix(secrets): add new field allow_substitution

* pull in types and integration testing

api/secret/create.go

@@ -234,6 +234,14 @@ func CreateSecret(c *gin.Context) {
 		input.SetAllowCommand(true)
 	}
 
+	// default to not allow substitution for shared secrets
+	if strings.EqualFold(input.GetType(), constants.SecretShared) && input.AllowSubstitution == nil {
+		input.SetAllowSubstitution(false)
+		input.SetAllowCommand(false)
+	} else if input.AllowSubstitution == nil {
+		input.SetAllowSubstitution(true)
+	}
+
 	// check if secret is a shared secret
 	if strings.EqualFold(t, constants.SecretShared) {
 		// update the team instead of repo

api/secret/update.go

@@ -152,6 +152,10 @@ func UpdateSecret(c *gin.Context) {
 		input.SetAllowCommand(input.GetAllowCommand())
 	}
 
+	if input.AllowSubstitution != nil {
+		input.SetAllowSubstitution(input.GetAllowSubstitution())
+	}
+
 	// check if secret is a shared secret
 	if strings.EqualFold(t, constants.SecretShared) {
 		// update the team instead of repo

database/integration_test.go

@@ -2314,6 +2314,7 @@ func newResources() *Resources {
 	secretOrg.SetEvents([]string{"push", "tag", "deployment"})
 	secretOrg.SetAllowEvents(library.NewEventsFromMask(1))
 	secretOrg.SetAllowCommand(true)
+	secretOrg.SetAllowSubstitution(true)
 	secretOrg.SetCreatedAt(time.Now().UTC().Unix())
 	secretOrg.SetCreatedBy("octocat")
 	secretOrg.SetUpdatedAt(time.Now().Add(time.Hour * 1).UTC().Unix())
@@ -2331,6 +2332,7 @@ func newResources() *Resources {
 	secretRepo.SetEvents([]string{"push", "tag", "deployment"})
 	secretRepo.SetAllowEvents(library.NewEventsFromMask(1))
 	secretRepo.SetAllowCommand(true)
+	secretRepo.SetAllowSubstitution(true)
 	secretRepo.SetCreatedAt(time.Now().UTC().Unix())
 	secretRepo.SetCreatedBy("octocat")
 	secretRepo.SetUpdatedAt(time.Now().Add(time.Hour * 1).UTC().Unix())
@@ -2347,6 +2349,7 @@ func newResources() *Resources {
 	secretShared.SetImages([]string{"alpine"})
 	secretShared.SetEvents([]string{"push", "tag", "deployment"})
 	secretShared.SetAllowCommand(true)
+	secretShared.SetAllowSubstitution(true)
 	secretShared.SetAllowEvents(library.NewEventsFromMask(1))
 	secretShared.SetCreatedAt(time.Now().UTC().Unix())
 	secretShared.SetCreatedBy("octocat")

database/secret/create_test.go

@@ -60,23 +60,23 @@ func TestSecret_Engine_CreateSecret(t *testing.T) {
 
 	// ensure the mock expects the repo secrets query
 	_mock.ExpectQuery(`INSERT INTO "secrets"
-("org","repo","team","name","value","type","images","events","allow_events","allow_command","created_at","created_by","updated_at","updated_by","id")
-VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15) RETURNING "id"`).
-		WithArgs("foo", "bar", nil, "baz", AnyArgument{}, "repo", nil, nil, 1, false, 1, "user", 1, "user2", 1).
+("org","repo","team","name","value","type","images","events","allow_events","allow_command","allow_substitution","created_at","created_by","updated_at","updated_by","id")
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16) RETURNING "id"`).
+		WithArgs("foo", "bar", nil, "baz", AnyArgument{}, "repo", nil, nil, 1, false, false, 1, "user", 1, "user2", 1).
 		WillReturnRows(_rows)
 
 	// ensure the mock expects the org secrets query
 	_mock.ExpectQuery(`INSERT INTO "secrets"
-("org","repo","team","name","value","type","images","events","allow_events","allow_command","created_at","created_by","updated_at","updated_by","id")
-VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15) RETURNING "id"`).
-		WithArgs("foo", "*", nil, "bar", AnyArgument{}, "org", nil, nil, 3, false, 1, "user", 1, "user2", 2).
+("org","repo","team","name","value","type","images","events","allow_events","allow_command","allow_substitution","created_at","created_by","updated_at","updated_by","id")
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16) RETURNING "id"`).
+		WithArgs("foo", "*", nil, "bar", AnyArgument{}, "org", nil, nil, 3, false, false, 1, "user", 1, "user2", 2).
 		WillReturnRows(_rows)
 
 	// ensure the mock expects the shared secrets query
 	_mock.ExpectQuery(`INSERT INTO "secrets"
-("org","repo","team","name","value","type","images","events","allow_events","allow_command","created_at","created_by","updated_at","updated_by","id")
-VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15) RETURNING "id"`).
-		WithArgs("foo", nil, "bar", "baz", AnyArgument{}, "shared", nil, nil, 1, false, 1, "user", 1, "user2", 3).
+("org","repo","team","name","value","type","images","events","allow_events","allow_command","allow_substitution","created_at","created_by","updated_at","updated_by","id")
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16) RETURNING "id"`).
+		WithArgs("foo", nil, "bar", "baz", AnyArgument{}, "shared", nil, nil, 1, false, false, 1, "user", 1, "user2", 3).
 		WillReturnRows(_rows)
 
 	_sqlite := testSqlite(t)

database/secret/get_org_test.go

@@ -32,8 +32,8 @@ func TestSecret_Engine_GetSecretForOrg(t *testing.T) {
 
 	// create expected result in mock
 	_rows := sqlmock.NewRows(
-		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "created_at", "created_by", "updated_at", "updated_by"}).
-		AddRow(1, "org", "foo", "*", "", "baz", "bar", nil, nil, 1, false, 1, "user", 1, "user2")
+		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "allow_substitution", "created_at", "created_by", "updated_at", "updated_by"}).
+		AddRow(1, "org", "foo", "*", "", "baz", "bar", nil, nil, 1, false, false, 1, "user", 1, "user2")
 
 	// ensure the mock expects the query
 	_mock.ExpectQuery(`SELECT * FROM "secrets" WHERE type = $1 AND org = $2 AND name = $3 LIMIT $4`).

database/secret/get_repo_test.go

@@ -42,8 +42,8 @@ func TestSecret_Engine_GetSecretForRepo(t *testing.T) {
 
 	// create expected result in mock
 	_rows := sqlmock.NewRows(
-		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "created_at", "created_by", "updated_at", "updated_by"}).
-		AddRow(1, "repo", "foo", "bar", "", "baz", "foob", nil, nil, 1, false, 1, "user", 1, "user2")
+		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "allow_substitution", "created_at", "created_by", "updated_at", "updated_by"}).
+		AddRow(1, "repo", "foo", "bar", "", "baz", "foob", nil, nil, 1, false, false, 1, "user", 1, "user2")
 
 	// ensure the mock expects the query
 	_mock.ExpectQuery(`SELECT * FROM "secrets" WHERE type = $1 AND org = $2 AND repo = $3 AND name = $4 LIMIT $5`).

database/secret/get_team_test.go

@@ -32,8 +32,8 @@ func TestSecret_Engine_GetSecretForTeam(t *testing.T) {
 
 	// create expected result in mock
 	_rows := sqlmock.NewRows(
-		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "created_at", "created_by", "updated_at", "updated_by"}).
-		AddRow(1, "shared", "foo", "", "bar", "baz", "foob", nil, nil, 1, false, 1, "user", 1, "user2")
+		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "allow_substitution", "created_at", "created_by", "updated_at", "updated_by"}).
+		AddRow(1, "shared", "foo", "", "bar", "baz", "foob", nil, nil, 1, false, false, 1, "user", 1, "user2")
 
 	// ensure the mock expects the query
 	_mock.ExpectQuery(`SELECT * FROM "secrets" WHERE type = $1 AND org = $2 AND team = $3 AND name = $4 LIMIT $5`).

database/secret/get_test.go

@@ -31,8 +31,8 @@ func TestSecret_Engine_GetSecret(t *testing.T) {
 
 	// create expected result in mock
 	_rows := sqlmock.NewRows(
-		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "created_at", "created_by", "updated_at", "updated_by"}).
-		AddRow(1, "repo", "foo", "bar", "", "baz", "foob", nil, nil, 1, false, 1, "user", 1, "user2")
+		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "allow_substitution", "created_at", "created_by", "updated_at", "updated_by"}).
+		AddRow(1, "repo", "foo", "bar", "", "baz", "foob", nil, nil, 1, false, false, 1, "user", 1, "user2")
 
 	// ensure the mock expects the query
 	_mock.ExpectQuery(`SELECT * FROM "secrets" WHERE id = $1 LIMIT $2`).WithArgs(1, 1).WillReturnRows(_rows)

database/secret/list_org_test.go

@@ -52,9 +52,9 @@ func TestSecret_Engine_ListSecretsForOrg(t *testing.T) {
 
 	// create expected name query result in mock
 	_rows = sqlmock.NewRows(
-		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "created_at", "created_by", "updated_at", "updated_by"}).
-		AddRow(2, "org", "foo", "*", "", "bar", "baz", nil, nil, 1, false, 1, "user", 1, "user2").
-		AddRow(1, "org", "foo", "*", "", "baz", "bar", nil, nil, 1, false, 1, "user", 1, "user2")
+		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "allow_substitution", "created_at", "created_by", "updated_at", "updated_by"}).
+		AddRow(2, "org", "foo", "*", "", "bar", "baz", nil, nil, 1, false, false, 1, "user", 1, "user2").
+		AddRow(1, "org", "foo", "*", "", "baz", "bar", nil, nil, 1, false, false, 1, "user", 1, "user2")
 
 	// ensure the mock expects the name query
 	_mock.ExpectQuery(`SELECT * FROM "secrets" WHERE type = $1 AND org = $2 ORDER BY id DESC LIMIT $3`).

database/secret/list_repo_test.go

@@ -63,9 +63,9 @@ func TestSecret_Engine_ListSecretsForRepo(t *testing.T) {
 
 	// create expected name query result in mock
 	_rows = sqlmock.NewRows(
-		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "created_at", "created_by", "updated_at", "updated_by"}).
-		AddRow(2, "repo", "foo", "bar", "", "foob", "baz", nil, nil, 1, false, 1, "user", 1, "user2").
-		AddRow(1, "repo", "foo", "bar", "", "baz", "foob", nil, nil, 1, false, 1, "user", 1, "user2")
+		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "allow_substitution", "created_at", "created_by", "updated_at", "updated_by"}).
+		AddRow(2, "repo", "foo", "bar", "", "foob", "baz", nil, nil, 1, false, false, 1, "user", 1, "user2").
+		AddRow(1, "repo", "foo", "bar", "", "baz", "foob", nil, nil, 1, false, false, 1, "user", 1, "user2")
 
 	// ensure the mock expects the name query
 	_mock.ExpectQuery(`SELECT * FROM "secrets" WHERE type = $1 AND org = $2 AND repo = $3 ORDER BY id DESC LIMIT $4`).

database/secret/list_team_test.go

@@ -53,9 +53,9 @@ func TestSecret_Engine_ListSecretsForTeam(t *testing.T) {
 
 	// create expected name query result in mock
 	_rows = sqlmock.NewRows(
-		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "created_at", "created_by", "updated_at", "updated_by"}).
-		AddRow(2, "shared", "foo", "", "bar", "foob", "baz", nil, nil, 1, false, 1, "user", 1, "user2").
-		AddRow(1, "shared", "foo", "", "bar", "baz", "foob", nil, nil, 1, false, 1, "user", 1, "user2")
+		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "allow_substitution", "created_at", "created_by", "updated_at", "updated_by"}).
+		AddRow(2, "shared", "foo", "", "bar", "foob", "baz", nil, nil, 1, false, false, 1, "user", 1, "user2").
+		AddRow(1, "shared", "foo", "", "bar", "baz", "foob", nil, nil, 1, false, false, 1, "user", 1, "user2")
 
 	// ensure the mock expects the name query
 	_mock.ExpectQuery(`SELECT * FROM "secrets" WHERE type = $1 AND org = $2 AND team = $3 ORDER BY id DESC LIMIT $4`).

database/secret/list_test.go

@@ -50,9 +50,9 @@ func TestSecret_Engine_ListSecrets(t *testing.T) {
 
 	// create expected result in mock
 	_rows = sqlmock.NewRows(
-		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "created_at", "created_by", "updated_at", "updated_by"}).
-		AddRow(1, "repo", "foo", "bar", "", "baz", "foob", nil, nil, 1, false, 1, "user", 1, "user2").
-		AddRow(2, "repo", "foo", "bar", "", "foob", "baz", nil, nil, 1, false, 1, "user", 1, "user2")
+		[]string{"id", "type", "org", "repo", "team", "name", "value", "images", "events", "allow_events", "allow_command", "allow_substitution", "created_at", "created_by", "updated_at", "updated_by"}).
+		AddRow(1, "repo", "foo", "bar", "", "baz", "foob", nil, nil, 1, false, false, 1, "user", 1, "user2").
+		AddRow(2, "repo", "foo", "bar", "", "foob", "baz", nil, nil, 1, false, false, 1, "user", 1, "user2")
 
 	// ensure the mock expects the query
 	_mock.ExpectQuery(`SELECT * FROM "secrets"`).WillReturnRows(_rows)

database/secret/secret_test.go

@@ -210,21 +210,22 @@ func testRepo() *library.Repo {
 // Secret type with all fields set to their zero values.
 func testSecret() *library.Secret {
 	return &library.Secret{
-		ID:           new(int64),
-		Org:          new(string),
-		Repo:         new(string),
-		Team:         new(string),
-		Name:         new(string),
-		Value:        new(string),
-		Type:         new(string),
-		Images:       new([]string),
-		Events:       new([]string),
-		AllowEvents:  testEvents(),
-		AllowCommand: new(bool),
-		CreatedAt:    new(int64),
-		CreatedBy:    new(string),
-		UpdatedAt:    new(int64),
-		UpdatedBy:    new(string),
+		ID:                new(int64),
+		Org:               new(string),
+		Repo:              new(string),
+		Team:              new(string),
+		Name:              new(string),
+		Value:             new(string),
+		Type:              new(string),
+		Images:            new([]string),
+		Events:            new([]string),
+		AllowEvents:       testEvents(),
+		AllowCommand:      new(bool),
+		AllowSubstitution: new(bool),
+		CreatedAt:         new(int64),
+		CreatedBy:         new(string),
+		UpdatedAt:         new(int64),
+		UpdatedBy:         new(string),
 	}
 }
 

database/secret/table.go

@@ -14,21 +14,22 @@ const (
 CREATE TABLE
 IF NOT EXISTS
 secrets (
-	id            SERIAL PRIMARY KEY,
-	type          VARCHAR(100),
-	org           VARCHAR(250),
-	repo          VARCHAR(250),
-	team          VARCHAR(250),
-	name          VARCHAR(250),
-	value         BYTEA,
-	images        VARCHAR(1000),
-	events        VARCHAR(1000),
-	allow_events  INTEGER,
-	allow_command BOOLEAN,
-	created_at    INTEGER,
-	created_by    VARCHAR(250),
-	updated_at    INTEGER,
-	updated_by    VARCHAR(250),
+	id                 SERIAL PRIMARY KEY,
+	type               VARCHAR(100),
+	org                VARCHAR(250),
+	repo               VARCHAR(250),
+	team               VARCHAR(250),
+	name               VARCHAR(250),
+	value              BYTEA,
+	images             VARCHAR(1000),
+	events             VARCHAR(1000),
+	allow_events       INTEGER,
+	allow_command      BOOLEAN,
+	allow_substitution BOOLEAN,
+	created_at         INTEGER,
+	created_by         VARCHAR(250),
+	updated_at         INTEGER,
+	updated_by         VARCHAR(250),
 	UNIQUE(type, org, repo, name),
 	UNIQUE(type, org, team, name)
 );
@@ -39,21 +40,22 @@ secrets (
 CREATE TABLE
 IF NOT EXISTS
 secrets (
-	id            INTEGER PRIMARY KEY AUTOINCREMENT,
-	type          TEXT,
-	org           TEXT,
-	repo          TEXT,
-	team          TEXT,
-	name          TEXT,
-	value         TEXT,
-	images        TEXT,
-	events        TEXT,
-	allow_events  INTEGER,
-	allow_command BOOLEAN,
-	created_at    INTEGER,
-	created_by	  TEXT,
-	updated_at    INTEGER,
-	updated_by    TEXT,
+	id                 INTEGER PRIMARY KEY AUTOINCREMENT,
+	type               TEXT,
+	org                TEXT,
+	repo               TEXT,
+	team               TEXT,
+	name               TEXT,
+	value              TEXT,
+	images             TEXT,
+	events             TEXT,
+	allow_events       INTEGER,
+	allow_command      BOOLEAN,
+	allow_substitution BOOLEAN,
+	created_at         INTEGER,
+	created_by	       TEXT,
+	updated_at         INTEGER,
+	updated_by         TEXT,
 	UNIQUE(type, org, repo, name),
 	UNIQUE(type, org, team, name)
 );

database/secret/update_test.go

@@ -57,23 +57,23 @@ func TestSecret_Engine_UpdateSecret(t *testing.T) {
 
 	// ensure the mock expects the repo query
 	_mock.ExpectExec(`UPDATE "secrets"
-SET "org"=$1,"repo"=$2,"team"=$3,"name"=$4,"value"=$5,"type"=$6,"images"=$7,"events"=$8,"allow_events"=$9,"allow_command"=$10,"created_at"=$11,"created_by"=$12,"updated_at"=$13,"updated_by"=$14
-WHERE "id" = $15`).
-		WithArgs("foo", "bar", nil, "baz", AnyArgument{}, "repo", nil, nil, 1, false, 1, "user", AnyArgument{}, "user2", 1).
+SET "org"=$1,"repo"=$2,"team"=$3,"name"=$4,"value"=$5,"type"=$6,"images"=$7,"events"=$8,"allow_events"=$9,"allow_command"=$10,"allow_substitution"=$11,"created_at"=$12,"created_by"=$13,"updated_at"=$14,"updated_by"=$15
+WHERE "id" = $16`).
+		WithArgs("foo", "bar", nil, "baz", AnyArgument{}, "repo", nil, nil, 1, false, false, 1, "user", AnyArgument{}, "user2", 1).
 		WillReturnResult(sqlmock.NewResult(1, 1))
 
 	// ensure the mock expects the org query
 	_mock.ExpectExec(`UPDATE "secrets"
-SET "org"=$1,"repo"=$2,"team"=$3,"name"=$4,"value"=$5,"type"=$6,"images"=$7,"events"=$8,"allow_events"=$9,"allow_command"=$10,"created_at"=$11,"created_by"=$12,"updated_at"=$13,"updated_by"=$14
-WHERE "id" = $15`).
-		WithArgs("foo", "*", nil, "bar", AnyArgument{}, "org", nil, nil, 1, false, 1, "user", AnyArgument{}, "user2", 2).
+SET "org"=$1,"repo"=$2,"team"=$3,"name"=$4,"value"=$5,"type"=$6,"images"=$7,"events"=$8,"allow_events"=$9,"allow_command"=$10,"allow_substitution"=$11,"created_at"=$12,"created_by"=$13,"updated_at"=$14,"updated_by"=$15
+WHERE "id" = $16`).
+		WithArgs("foo", "*", nil, "bar", AnyArgument{}, "org", nil, nil, 1, false, false, 1, "user", AnyArgument{}, "user2", 2).
 		WillReturnResult(sqlmock.NewResult(1, 1))
 
 	// ensure the mock expects the shared query
 	_mock.ExpectExec(`UPDATE "secrets"
-SET "org"=$1,"repo"=$2,"team"=$3,"name"=$4,"value"=$5,"type"=$6,"images"=$7,"events"=$8,"allow_events"=$9,"allow_command"=$10,"created_at"=$11,"created_by"=$12,"updated_at"=$13,"updated_by"=$14
-WHERE "id" = $15`).
-		WithArgs("foo", nil, "bar", "baz", AnyArgument{}, "shared", nil, nil, 1, false, 1, "user", NowTimestamp{}, "user2", 3).
+SET "org"=$1,"repo"=$2,"team"=$3,"name"=$4,"value"=$5,"type"=$6,"images"=$7,"events"=$8,"allow_events"=$9,"allow_command"=$10,"allow_substitution"=$11,"created_at"=$12,"created_by"=$13,"updated_at"=$14,"updated_by"=$15
+WHERE "id" = $16`).
+		WithArgs("foo", nil, "bar", "baz", AnyArgument{}, "shared", nil, nil, 1, false, false, 1, "user", NowTimestamp{}, "user2", 3).
 		WillReturnResult(sqlmock.NewResult(1, 1))
 
 	_sqlite := testSqlite(t)

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/drone/envsubst v1.0.3
 	github.com/gin-gonic/gin v1.9.1
 	github.com/go-playground/assert/v2 v2.2.0
-	github.com/go-vela/types v0.23.1
+	github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe
 	github.com/golang-jwt/jwt/v5 v5.2.0
 	github.com/google/go-cmp v0.6.0
 	github.com/google/go-github/v59 v59.0.0

go.sum

@@ -86,8 +86,8 @@ github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg
 github.com/go-playground/validator/v10 v10.14.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
 github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
 github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-vela/types v0.23.1 h1:st4BeDcYVyaaFqblU1YroztNvmYLBgmfZpWq0En0Sg0=
-github.com/go-vela/types v0.23.1/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=
+github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe h1:Fb28yre0nrX1GNeyPN8i8rruTlW8MnPVF3Fo5xTuOkg=
+github.com/go-vela/types v0.23.2-0.20240312183632-2e046fceb8fe/go.mod h1:AAqgxIw1aRBgPkE/5juGuiwh/JZuOtL8fcPaEkjFWwQ=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=

mock/server/secret.go

@@ -49,6 +49,7 @@ const (
 	  }
   },
   "allow_command": true,
+  "allow_substitution": true,
   "created_at": 1,
   "created_by": "Octocat",
   "updated_at": 2,