Documentation
¶
Index ¶
- func BuildSecretResolver(vars env.Environment) (*secret.MultiResolver, error)
- func DecodeFanOutConfig(raw []byte) (*jobdefschema.FanOut, error)
- func InterpolateParamRefs(env map[string]string, params map[string]string) (map[string]string, error)
- func ResolveContainerSpecSecrets(ctx context.Context, resolver secret.Resolver, spec container.Spec) (container.Spec, error)
- type ResolvedSecretIdentity
- type Watch
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BuildSecretResolver ¶
func BuildSecretResolver(vars env.Environment) (*secret.MultiResolver, error)
BuildSecretResolver constructs the resolver chain based on environment variables.
func DecodeFanOutConfig ¶
func DecodeFanOutConfig(raw []byte) (*jobdefschema.FanOut, error)
DecodeFanOutConfig unmarshals the catalog Task.FanOutConfig JSON onto the job-definition FanOut struct. Nil/empty raw returns (nil, nil).
func InterpolateParamRefs ¶
func InterpolateParamRefs(env map[string]string, params map[string]string) (map[string]string, error)
InterpolateParamRefs substitutes ${CAESIUM_PARAM_<NAME>} in env values from run parameters. Callers must apply it to the step-declared env before the cache hash is computed and before the container is created, so two runs with different params cannot cache-hit on a shared token and so reagents that are not a shell (git-source GIT_REF) see the substituted value.
Unresolved references fail closed: the token is never left in place and never replaced with an empty string. An explicitly empty param value is present and is substituted as empty. Param keys that fold to the same strings.ToUpper name (SHA vs sha) fail closed so the selected value cannot depend on map iteration order. After substitution, a value that is a secret:// URI and differs from the job-definition original is rejected: secret identifiers must stay static so a trigger caller cannot select which secret is resolved. The returned map is a copy; env is never mutated. Command/args are not interpolated.
func ResolveContainerSpecSecrets ¶
func ResolveContainerSpecSecrets(ctx context.Context, resolver secret.Resolver, spec container.Spec) (container.Spec, error)
ResolveContainerSpecSecrets resolves secret:// values in the step-declared environment at container-create time. It leaves non-secret values unchanged and returns a copied spec so callers do not mutate cached atom specs.
Types ¶
type ResolvedSecretIdentity ¶
ResolvedSecretIdentity is the identity metadata captured for one resolved environment secret reference.
func ResolveContainerSpecSecretsWithIdentities ¶
func ResolveContainerSpecSecretsWithIdentities(ctx context.Context, resolver secret.Resolver, spec container.Spec) (container.Spec, []ResolvedSecretIdentity, error)
ResolveContainerSpecSecretsWithIdentities resolves secret:// values and returns the provider identity for every resolved secret reference.
type Watch ¶
Watch encapsulates the configuration required to start a Git sync watcher.
func BuildGitWatches ¶
BuildGitWatches converts the Git environment configuration into watch descriptors.
Source Files