Documentation
¶
Overview ¶
Package diff provides change detection and reporting for secrets synchronization. It enables dry-run validation, zero-sum differential verification, and CI/CD-friendly output formats.
Index ¶
- func FormatDiff(diff *PipelineDiff, format OutputFormat) string
- func FormatDiffWithOptions(diff *PipelineDiff, format OutputFormat, showValues bool) string
- func RedactChangeValues(changes []SecretChange)
- type ChangeSummary
- type ChangeType
- type DiffResult
- type OutputFormat
- type PipelineDiff
- type SecretChange
- type TargetDiff
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FormatDiff ¶
func FormatDiff(diff *PipelineDiff, format OutputFormat) string
FormatDiff formats the pipeline diff according to the specified format
func FormatDiffWithOptions ¶
func FormatDiffWithOptions(diff *PipelineDiff, format OutputFormat, showValues bool) string
FormatDiffWithOptions formats the pipeline diff with additional options.
Raw secret values are stripped here, before any formatter runs, unless the caller explicitly asks for them. Redacting at this single chokepoint rather than in each caller means a new output format or a new entry point cannot leak values by omission: previously only the side-by-side formatter honored showValues, so JSON output carried plaintext secrets straight into Lambda responses and CloudWatch logs.
func RedactChangeValues ¶
func RedactChangeValues(changes []SecretChange)
RedactChangeValues removes raw secret values from a slice of changes in place. Result diffs are owned by the caller that is about to serialize them, so unlike RedactValues there is no shared state to preserve.
Types ¶
type ChangeSummary ¶
type ChangeSummary struct {
Added int `json:"added"`
Removed int `json:"removed"`
Modified int `json:"modified"`
Unchanged int `json:"unchanged"`
Total int `json:"total"`
}
ChangeSummary provides statistics about changes
func ComputeSummary ¶
func ComputeSummary(changes []SecretChange) ChangeSummary
ComputeSummary calculates summary statistics from changes
func (ChangeSummary) HasChanges ¶
func (s ChangeSummary) HasChanges() bool
HasChanges returns true if there are any changes
func (ChangeSummary) IsZeroSum ¶
func (s ChangeSummary) IsZeroSum() bool
IsZeroSum returns true if there are no changes
type ChangeType ¶
type ChangeType string
ChangeType represents the type of change detected
const ( ChangeTypeAdded ChangeType = "added" ChangeTypeRemoved ChangeType = "removed" ChangeTypeModified ChangeType = "modified" ChangeTypeUnchanged ChangeType = "unchanged" )
type DiffResult ¶
type DiffResult struct {
Diff *PipelineDiff `json:"diff"`
ExitCode int `json:"exit_code"`
Message string `json:"message"`
}
DiffResult wraps PipelineDiff with additional metadata for CLI output
func NewDiffResult ¶
func NewDiffResult(diff *PipelineDiff) *DiffResult
NewDiffResult creates a DiffResult from a PipelineDiff
type OutputFormat ¶
type OutputFormat string
OutputFormat specifies the output format for diff reporting
const ( OutputFormatHuman OutputFormat = "human" OutputFormatJSON OutputFormat = "json" OutputFormatGitHub OutputFormat = "github" // GitHub Actions annotations OutputFormatCompact OutputFormat = "compact" // One-line summary OutputFormatSideBySide OutputFormat = "sidebyside" // Side-by-side comparison )
type PipelineDiff ¶
type PipelineDiff struct {
Targets []TargetDiff `json:"targets"`
Summary ChangeSummary `json:"summary"`
DryRun bool `json:"dry_run"`
ConfigPath string `json:"config_path,omitempty"`
}
PipelineDiff represents the complete diff for a pipeline run
func RedactValues ¶
func RedactValues(diff *PipelineDiff) *PipelineDiff
RedactValues returns a copy of the diff with raw secret values removed, leaving the metadata that makes a diff useful -- paths, change types, key names and hashes -- intact.
The copy is deliberate. Callers keep using the diff after formatting, for audit records and for the Result they return, so stripping in place would blank data those consumers legitimately hold.
func (*PipelineDiff) AddTargetDiff ¶
func (p *PipelineDiff) AddTargetDiff(td TargetDiff)
AddTargetDiff adds a target diff and updates the summary
func (*PipelineDiff) ExitCode ¶
func (p *PipelineDiff) ExitCode() int
ExitCode returns an appropriate exit code for CI/CD:
- 0: No changes (zero-sum)
- 1: Changes detected
- 2: Errors occurred (not handled here)
func (*PipelineDiff) IsZeroSum ¶
func (p *PipelineDiff) IsZeroSum() bool
IsZeroSum returns true if the entire pipeline has no changes
type SecretChange ¶
type SecretChange struct {
Path string `json:"path"`
ChangeType ChangeType `json:"change_type"`
Target string `json:"target,omitempty"`
// Version tracking
CurrentVersion int `json:"current_version,omitempty"`
DesiredVersion int `json:"desired_version,omitempty"`
// For modified secrets, track key-level changes
KeysAdded []string `json:"keys_added,omitempty"`
KeysRemoved []string `json:"keys_removed,omitempty"`
KeysModified []string `json:"keys_modified,omitempty"`
// Current and desired states (values redacted by default)
CurrentKeys []string `json:"current_keys,omitempty"`
DesiredKeys []string `json:"desired_keys,omitempty"`
// Hash comparison for change detection without exposing values
CurrentHash string `json:"current_hash,omitempty"`
DesiredHash string `json:"desired_hash,omitempty"`
// Enhanced diff output
CurrentValues map[string]interface{} `json:"current_values,omitempty"` // For side-by-side comparison
DesiredValues map[string]interface{} `json:"desired_values,omitempty"` // For side-by-side comparison
ShowValues bool `json:"show_values,omitempty"` // Whether to show actual values
}
SecretChange represents a change to a single secret
func DiffSecrets ¶
func DiffSecrets(current, desired map[string]interface{}) []SecretChange
DiffSecrets compares two secret maps and returns the changes
func DiffSecretsWithValues ¶
func DiffSecretsWithValues(current, desired map[string]interface{}, currentVersions, desiredVersions map[string]int, showValues bool) []SecretChange
DiffSecretsWithValues compares secrets and includes values for side-by-side comparison
func DiffSecretsWithVersions ¶
func DiffSecretsWithVersions(current, desired map[string]interface{}, currentVersions, desiredVersions map[string]int) []SecretChange
DiffSecretsWithVersions compares two secret maps with version information and returns the changes
type TargetDiff ¶
type TargetDiff struct {
Target string `json:"target"`
Changes []SecretChange `json:"changes"`
Summary ChangeSummary `json:"summary"`
}
TargetDiff represents all changes for a single target
Source Files