feat(canonical): validate profile name, apply env-var substitution before render

2026-10-20 01:27:50 +00:00 · 2026-05-23 11:55:26 +01:00
parent 5e35dc47fe
commit 50059d7517
14 changed files with 423 additions and 23 deletions
@@ -0,0 +1,74 @@
+package canonical
+
+import (
+	"fmt"
+
+	"github.com/lukaszraczylo/harness-sync/internal/secrets"
+)
+
+// SubstituteSecrets walks the bundle and replaces ${VAR} placeholders in all
+// config fields using lookup. Skill/agent/instruction bodies are intentionally
+// NOT substituted — they are content, not config.
+//
+// Returns an error (wrapping the offending field path) if any referenced
+// variable is missing from lookup.
+func SubstituteSecrets(b *Bundle, lookup secrets.Lookup) error {
+	var err error
+
+	// Gateway
+	if b.Profile.Gateway.Token, err = sub(lookup, "profile.gateway.token", b.Profile.Gateway.Token); err != nil {
+		return err
+	}
+	if b.Profile.Gateway.URL, err = sub(lookup, "profile.gateway.url", b.Profile.Gateway.URL); err != nil {
+		return err
+	}
+	if b.Profile.Gateway.DefaultModel, err = sub(lookup, "profile.gateway.default_model", b.Profile.Gateway.DefaultModel); err != nil {
+		return err
+	}
+
+	// Upstreams
+	for i := range b.Profile.Upstreams {
+		u := &b.Profile.Upstreams[i]
+		field := fmt.Sprintf("profile.upstreams[%d](%s)", i, u.Name)
+		if u.APIKey, err = sub(lookup, field+".api_key", u.APIKey); err != nil {
+			return err
+		}
+		if u.BaseURL, err = sub(lookup, field+".base_url", u.BaseURL); err != nil {
+			return err
+		}
+	}
+
+	// MCP servers
+	for i := range b.MCP.Servers {
+		sv := &b.MCP.Servers[i]
+		field := fmt.Sprintf("mcp.servers[%d](%s)", i, sv.Name)
+
+		if sv.Command, err = sub(lookup, field+".command", sv.Command); err != nil {
+			return err
+		}
+		if sv.URL, err = sub(lookup, field+".url", sv.URL); err != nil {
+			return err
+		}
+		for j, arg := range sv.Args {
+			if sv.Args[j], err = sub(lookup, fmt.Sprintf("%s.args[%d]", field, j), arg); err != nil {
+				return err
+			}
+		}
+		for k, v := range sv.Env {
+			if sv.Env[k], err = sub(lookup, fmt.Sprintf("%s.env[%s]", field, k), v); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// sub applies secrets.Substitute and wraps errors with field context.
+func sub(lookup secrets.Lookup, field, value string) (string, error) {
+	result, err := secrets.Substitute(value, lookup)
+	if err != nil {
+		return "", fmt.Errorf("%s: %w", field, err)
+	}
+	return result, nil
+}