[envsec] Initial envsec integration #1474
Conversation
| func envsecList(projectDir string) (map[string]string, error) { | ||
| cmd := exec.Command( | ||
| "envsec", "ls", "--show", | ||
| "--format", "json", |
There was a problem hiding this comment.
I'm not sure if we should do this. I worry that the secrets printed can be discovered through some proc file somewhere.
Can we use the envsec go library directly instead?
There was a problem hiding this comment.
I was under impression we wanted to do CLI integration in order to avoid bloating devbox. This has the benefit of allowing other 3rd parties to integrate as well if we provide a standard interface.
If stderr and stdout are captured in a buffer, is there really any risk the outputs ends up anywhere else?
We can also go the RPC route, but that's more work and feels a bit overkill.
There was a problem hiding this comment.
Looking deeper it might be ok based on this line. So I guess we are good
| func envsecList(projectDir string) (map[string]string, error) { | ||
| cmd := exec.Command( | ||
| "envsec", "ls", "--show", | ||
| "--format", "json", |
There was a problem hiding this comment.
Looking deeper it might be ok based on this line. So I guess we are good
Summary
This pre-mvp integration is mostly just to get something working. It's missing a lot of stuff. Specifically:
--jsonoutput so we don't have to do clever parsing).envsec.Envgets called a few times and not cached.One open question is how generic we want to make the integration. This implementation is pretty coupled.
How was it tested?