feat(config): lark-channel secret supports SecretInput protocol#912
Conversation
github-actions
Bot
added
the
size/L
📝 WalkthroughWalkthroughThis PR extends lark-channel config handling to support the SecretInput protocol, enabling environment-template and secret-reference secrets. The config schema is updated to include optional secret providers, app secrets now use the SecretInput type, the binder implements proper secret resolution with error hints, and comprehensive tests validate parsing and integration flows. ChangesLark-channel secret input protocol integration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #912 +/- ##
==========================================
- Coverage 65.95% 65.92% -0.04%
==========================================
Files 523 523
Lines 49590 49692 +102
==========================================
+ Hits 32707 32758 +51
- Misses 14090 14134 +44
- Partials 2793 2800 +7 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@93a2b6b3d4e797f200a35491d8dfe870f0e05af0🧩 Skill updatenpx skills add larksuite/cli#feat/lark-channel-secret-resolve -y -g |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
cmd/config/bind_test.go (1)
414-429: 💤 Low valueConsider verifying the resolved secret value in the keychain.
The test confirms the bind operation succeeds but doesn't verify that the keychain received the resolved environment value
"resolved_via_env"rather than the literal template string"${LARK_APP_SECRET}". While this matches the pattern inTestConfigBindRun_OpenClawEnvTemplate(lines 1373-1406), a stronger assertion would load the workspace config and verify the secret was resolved, similar to the approach inTestConfigBindRun_LarkChannel_Success(lines 398-408).This is optional—the current test does validate the integration contract (bind succeeds with env-template secrets), but explicit verification of the resolved value would increase confidence in the SecretInput resolution pipeline.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/config/bind_test.go` around lines 414 - 429, Update TestConfigBindRun_LarkChannel_EnvTemplate to also load the saved workspace config/keychain after calling configBindRun and assert the Lark app secret was stored as the resolved value "resolved_via_env" (not the literal "${LARK_APP_SECRET}"). Specifically, after calling configBindRun(&BindOptions{Factory: f, Source: "lark-channel"}), use the test Factory (f) to open the workspace or keychain (same approach used in TestConfigBindRun_LarkChannel_Success) and verify the secret entry for the app id "cli_lc_env" equals "resolved_via_env"; fail the test if the stored value does not match.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@cmd/config/bind_test.go`:
- Around line 414-429: Update TestConfigBindRun_LarkChannel_EnvTemplate to also
load the saved workspace config/keychain after calling configBindRun and assert
the Lark app secret was stored as the resolved value "resolved_via_env" (not the
literal "${LARK_APP_SECRET}"). Specifically, after calling
configBindRun(&BindOptions{Factory: f, Source: "lark-channel"}), use the test
Factory (f) to open the workspace or keychain (same approach used in
TestConfigBindRun_LarkChannel_Success) and verify the secret entry for the app
id "cli_lc_env" equals "resolved_via_env"; fail the test if the stored value
does not match.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 71b100fc-bc0e-43c0-aacb-fd74de5526f3
📒 Files selected for processing (4)
cmd/config/bind_test.gocmd/config/binder.gointernal/binding/lark_channel.gointernal/binding/lark_channel_test.go
2 participants
Align lark-channel source with openclaw's generic SecretInput protocol so
bridge configs can keep secrets out of ~/.lark-channel/config.json.
SecretInput (accepts string / "${VAR}" template / {source,id} ref);
LarkChannelRoot adds optional Secrets *SecretsConfig for exec providers.
binding.ResolveSecretInput (same path as openclaw).
Enables three new secret forms for lark-channel users:
Summary by CodeRabbit
New Features
Improvements