feat(secrets): support SOPS-encrypted secret sources

cmd/ci/ci.go

@@ -139,16 +139,21 @@ func (cmd *CICmd) registerSecretsFlags(ciCmd *cobra.Command) {
 		cliflags.String(&cmd.FeatureSecretsFile, names.FeatureSecretsFile, "",
 			"Path to a JSON file containing secret values for features, format: "+
 				`{"featureId": {"optionName": "value"}}`),
-		cliflags.StringArray(&cmd.Secrets, names.Secret, nil,
-			"Stored Devsy secret to inject, as NAME[,type=env|mount][,target=X]; "+
-				"type=env (default) sets an env var, type=mount writes /run/secrets/<target>. Repeatable"),
+		cliflags.StringArray(
+			&cmd.Secrets,
+			names.Secret,
+			nil,
+			"Secret to inject: NAME or source-qualified TYPE:SOURCE/NAME[,type=env|mount][,target=X]; "+
+				"type=env (default) sets an env var, type=mount writes /run/secrets/<target>. Repeatable",
+		),
 		cliflags.StringArray(&cmd.EnvVars, names.Env, nil,
 			"Stored Devsy env var to inject into the workspace as NAME[=TARGET]. Repeatable"),
 		cliflags.StringArray(&cmd.BuildSecretNames, names.BuildSecret, nil,
-			"Stored Devsy secret exposed to the build via BuildKit "+
+			"Secret to expose to the build via BuildKit; accepts NAME or TYPE:SOURCE/NAME "+
 				"(RUN --mount=type=secret,id=NAME). Repeatable"),
 		cliflags.String(&cmd.GitTokenSecret, names.GitToken, "",
-			"Stored Devsy secret holding an access token for cloning a private HTTP repository"),
+			"Secret holding an access token for cloning a private HTTP repository; "+
+				"accepts NAME or TYPE:SOURCE/NAME; repository-owned sources cannot bootstrap their own clone"),
 		cliflags.String(&cmd.GitTokenUsername, names.GitTokenUsername, "",
 			"Username for --git-token (default inferred from the repo host)"),
 	)

cmd/secrets/bind.go

@@ -20,7 +20,7 @@ func NewAttachCmd(flags *flags.GlobalFlags) *cobra.Command {
 	cmd := &AttachCmd{GlobalFlags: flags}
 	attachCmd := &cobra.Command{
 		Use:   "attach NAME",
-		Short: "Bind a secret to the active context so it is injected automatically on up",
+		Short: "Bind a secret reference to the active context so it is injected automatically on up",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cobraCmd *cobra.Command, args []string) error {
 			return cmd.Run(cobraCmd.Context(), args[0])
@@ -30,7 +30,7 @@ func NewAttachCmd(flags *flags.GlobalFlags) *cobra.Command {
 	return attachCmd
 }
 
-func verifySensitive(devsyConfig *config.Config, contextName, name string) error {
+func verifyLocalSensitive(devsyConfig *config.Config, contextName, name string) error {
 	store, err := secrets.NewStoreForConfig(devsyConfig)
 	if err != nil {
 		return err
@@ -45,36 +45,61 @@ func verifySensitive(devsyConfig *config.Config, contextName, name string) error
 	return nil
 }
 
-func (cmd *AttachCmd) Run(_ context.Context, name string) error {
-	if err := secrets.ValidateName(name); err != nil {
+func verifySecretReference(
+	ctx context.Context,
+	devsyConfig *config.Config,
+	ref secrets.SecretRef,
+) error {
+	if ref.Source == secrets.LocalSourceName &&
+		(ref.Type == "" || ref.Type == secrets.LocalSourceName) {
+		return verifyLocalSensitive(devsyConfig, devsyConfig.DefaultContext, ref.Name)
+	}
+	resolver, err := secrets.NewResolverForConfig(devsyConfig)
+	if err != nil {
+		return err
+	}
+	resolved, err := resolver.Resolve(ctx, ref)
+	if err != nil {
+		return fmt.Errorf("cannot attach secret %q: %w", ref.String(), err)
+	}
+	if !resolved.Sensitive {
+		return fmt.Errorf("%q is not a sensitive secret", ref.String())
+	}
+	return nil
+}
+
+func (cmd *AttachCmd) Run(ctx context.Context, name string) error {
+	ref, err := secrets.ParseRef(name)
+	if err != nil {
 		return err
 	}
+	canonical := ref.String()
 
 	devsyConfig, err := config.LoadConfig(cmd.Context, cmd.Provider)
 	if err != nil {
 		return err
 	}
 	contextName := devsyConfig.DefaultContext
 
-	if err := verifySensitive(devsyConfig, contextName, name); err != nil {
+	if err := verifySecretReference(ctx, devsyConfig, ref); err != nil {
 		return err
 	}
 
 	ctxConfig := devsyConfig.Contexts[contextName]
 	if ctxConfig == nil {
 		return fmt.Errorf("context %q doesn't exist", contextName)
 	}
-	if slices.Contains(ctxConfig.Secrets, name) {
-		log.Infof("secret %q already attached to context %q", name, contextName)
+	if slices.Contains(ctxConfig.Secrets, canonical) {
+		log.Infof("secret %q already attached to context %q", canonical, contextName)
 		return nil
 	}
-	ctxConfig.Secrets = append(ctxConfig.Secrets, name)
+	ctxConfig.Secrets = append(ctxConfig.Secrets, canonical)
 
 	if err := config.SaveConfig(devsyConfig); err != nil {
 		return fmt.Errorf("save config: %w", err)
 	}
 
-	log.Infof("secret %q attached to context %q", name, contextName)
+	log.Infof("secret %q attached to context %q", canonical, contextName)
 	return nil
 }
 
@@ -86,7 +111,7 @@ func NewDetachCmd(flags *flags.GlobalFlags) *cobra.Command {
 	cmd := &DetachCmd{GlobalFlags: flags}
 	detachCmd := &cobra.Command{
 		Use:   "detach NAME",
-		Short: "Unbind a secret from the active context",
+		Short: "Unbind a secret reference from the active context",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cobraCmd *cobra.Command, args []string) error {
 			return cmd.Run(cobraCmd.Context(), args[0])
@@ -97,6 +122,11 @@ func NewDetachCmd(flags *flags.GlobalFlags) *cobra.Command {
 }
 
 func (cmd *DetachCmd) Run(_ context.Context, name string) error {
+	ref, err := secrets.ParseRef(name)
+	if err != nil {
+		return err
+	}
+	canonical := ref.String()
 	devsyConfig, err := config.LoadConfig(cmd.Context, cmd.Provider)
 	if err != nil {
 		return err
@@ -108,9 +138,9 @@ func (cmd *DetachCmd) Run(_ context.Context, name string) error {
 		return fmt.Errorf("context %q doesn't exist", contextName)
 	}
 
-	idx := slices.Index(ctxConfig.Secrets, name)
+	idx := slices.Index(ctxConfig.Secrets, canonical)
 	if idx < 0 {
-		log.Infof("secret %q is not attached to context %q", name, contextName)
+		log.Infof("secret %q is not attached to context %q", canonical, contextName)
 		return nil
 	}
 	ctxConfig.Secrets = slices.Delete(ctxConfig.Secrets, idx, idx+1)
@@ -119,6 +149,6 @@ func (cmd *DetachCmd) Run(_ context.Context, name string) error {
 		return fmt.Errorf("save config: %w", err)
 	}
 
-	log.Infof("secret %q detached from context %q", name, contextName)
+	log.Infof("secret %q detached from context %q", canonical, contextName)
 	return nil
 }

cmd/secrets/secrets.go

@@ -10,12 +10,13 @@ import (
 func NewSecretsCmd(flags *flags.GlobalFlags) *cobra.Command {
 	secretsCmd := &cobra.Command{
 		Use:   "secret",
-		Short: "Manage secrets",
-		Long: `Manage named secrets stored locally and injected into workspaces.
+		Short: "Manage secrets and external secret sources",
+		Long: `Manage secrets and external secret sources used by Devsy workspaces.
 
-Secret values are kept in the OS keyring (macOS Keychain, Windows Credential
-Manager, or libsecret) when available, and in an age-encrypted file otherwise.
-Only non-sensitive metadata is stored in the Devsy config directory.`,
+Managed secret values are kept in the OS keyring (macOS Keychain,
+Windows Credential Manager, or libsecret) when available, and in an
+age-encrypted file otherwise. External sources such as SOPS remain owned by
+their encrypted source file and are resolved only when needed.`,
 	}
 
 	secretsCmd.AddCommand(NewSetCmd(flags))
@@ -24,6 +25,7 @@ Only non-sensitive metadata is stored in the Devsy config directory.`,
 	secretsCmd.AddCommand(NewDeleteCmd(flags))
 	secretsCmd.AddCommand(NewAttachCmd(flags))
 	secretsCmd.AddCommand(NewDetachCmd(flags))
+	secretsCmd.AddCommand(NewSourceCmd(flags))
 	return secretsCmd
 }