feat(cli): add secrets list CLI command and github ci secrets masking
#520
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
📝 WalkthroughWalkthroughThe changes introduce significant refactoring and new features to the secrets management CLI in the Airbyte CDK. The Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant CLI
participant GSMClient as Google Secret Manager Client
participant FileSystem
User->>CLI: Run 'secrets fetch' or 'secrets list' command
CLI->>CLI: Resolve connector name (resolve_connector_name)
CLI->>CLI: Get GSM client (_get_gsm_secrets_client)
CLI->>GSMClient: Fetch secrets with label filtering (_fetch_secret_handles)
alt fetch command
loop For each secret
CLI->>CLI: Determine file path (_get_secret_filepath)
CLI->>FileSystem: Write secret to file (_write_secret_file)
end
CLI->>User: Output number of secrets written or error
else list command
CLI->>User: Display secrets in table format
end
Would you like me to also generate a comparison sequence diagram showing the old vs new control flow for the 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🧰 Additional context used🧬 Code Graph Analysis (1)airbyte_cdk/cli/airbyte_cdk/_secrets.py (1)
⏰ Context from checks skipped due to timeout of 90000ms (10)
🔇 Additional comments (12)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
airbyte_cdk/cli/airbyte_cdk/_util.py (1)
46-69: Clean implementation of connector name resolution!This function properly extracts and validates connector names from directory paths with good error messages. It elegantly complements the existing
resolve_connector_name_and_directoryfunction for cases when you already have a directory path.Just a minor suggestion - would it make sense to add a guard against non-existing directories by checking
connector_directory.exists()as well? wdyt?if not connector_directory: raise FileNotFoundError( "Connector directory does not exist or cannot be found. Please provide a valid " "connector directory." ) +if not connector_directory.exists(): + raise FileNotFoundError( + f"Connector directory {connector_directory.absolute()} does not exist. Please provide a valid " + "connector directory." + )
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
airbyte_cdk/cli/airbyte_cdk/_secrets.py(3 hunks)airbyte_cdk/cli/airbyte_cdk/_util.py(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (1)
airbyte_cdk/cli/airbyte_cdk/_util.py (2)
resolve_connector_name(46-69)resolve_connector_name_and_directory(8-43)
🪛 GitHub Actions: Linters
airbyte_cdk/cli/airbyte_cdk/_secrets.py
[error] 191-191: mypy error: Secret? has no attribute "name" (attr-defined)
[error] 192-192: mypy error: Secret? has no attribute "labels" (attr-defined)
[error] 193-193: mypy error: Secret? has no attribute "create_time" (attr-defined)
[error] 230-230: mypy error: Secret? has no attribute "name" (attr-defined)
[error] 272-272: mypy error: Secret? has no attribute "labels" (attr-defined)
[error] 273-273: mypy error: Secret? has no attribute "labels" (attr-defined)
🪛 GitHub Actions: Dependency Analysis
airbyte_cdk/cli/airbyte_cdk/_secrets.py
[error] 28-28: 'rich' imported but it is a transitive dependency (DEP003)
[error] 29-29: 'rich' imported but it is a transitive dependency (DEP003)
⏰ Context from checks skipped due to timeout of 90000ms (4)
- GitHub Check: Check: 'source-amplitude' (skip=false)
- GitHub Check: Check: 'source-shopify' (skip=false)
- GitHub Check: Pytest (All, Python 3.11, Ubuntu)
- GitHub Check: Pytest (All, Python 3.10, Ubuntu)
🔇 Additional comments (6)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (6)
51-57: Type ignore is appropriate hereGood call on using
# type: ignoreto suppress the type checking issue with the help text.
91-127: Nice refactoring of the fetch command!This refactoring significantly improves the code organization by breaking down the functionality into smaller, reusable functions. The command flow is now much clearer and easier to understand.
I especially like the improved error reporting when no secrets are found.
199-223: Good approach to fetching secret handlesThe type annotation with comment-based
# type: ignoreis a reasonable workaround, though usingcastwould be more type-safe as suggested earlier.
225-234: File permission handling is a nice security touch!Setting the file permissions to 0o600 (owner read/write only) is a good security practice for secret files.
🧰 Tools
🪛 GitHub Actions: Linters
[error] 230-230: mypy error: Secret? has no attribute "name" (attr-defined)
236-264: Thoughtful directory setup with .gitignoreAutomatically creating a .gitignore file with '*' in the secrets directory is a good safeguard against accidentally committing secrets.
267-276: Good handling of custom filenames via labelsUsing the 'filename' label to customize the output file is a nice touch!
🧰 Tools
🪛 GitHub Actions: Linters
[error] 272-272: mypy error: Secret? has no attribute "labels" (attr-defined)
[error] 273-273: mypy error: Secret? has no attribute "labels" (attr-defined)
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (1)
130-197:⚠️ Potential issueExcellent new list command, but type errors need fixing!
The new command provides a valuable way to view available secrets without downloading them. The rich table output looks fantastic.
However, there are several mypy errors related to accessing attributes of
Secretobjects. Could we fix this with cast operations? wdyt?for secret in secrets: table.add_row( - secret.name.split("/secrets/")[-1], # Name of the secret, without the prefix - "\n".join([f"{k}={v}" for k, v in secret.labels.items()]), - str(secret.create_time), + cast(str, secret.name).split("/secrets/")[-1], # Name of the secret, without the prefix + "\n".join([f"{k}={v}" for k, v in cast(dict, secret.labels).items()]), + str(cast(Any, secret.create_time)), )🧰 Tools
🪛 GitHub Actions: Linters
[error] 192-192: mypy: Secret? has no attribute "name" (attr-defined)
[error] 193-193: mypy: Secret? has no attribute "labels" (attr-defined)
[error] 194-194: mypy: Secret? has no attribute "create_time" (attr-defined)
🧹 Nitpick comments (2)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (2)
19-50: Clean import structure with conditional dependencies!I like the approach of conditionally importing Google Secret Manager modules and providing helpful error messages at runtime. The typing additions are also good for maintainability.
One small suggestion - would it make sense to use the TypeVar to create a more specific type hint for Secret? Perhaps something like:
- Secret: type | None + # Define a type alias that can be used when the module isn't loaded + SecretType = TypeVar("SecretType", bound="Any") + Secret: type[SecretType] | NoneThis might help with some of the type checking issues we're seeing elsewhere. wdyt?
200-224: Helpful function for fetching secret handles!This extraction of secret handling logic makes the code more maintainable. The type annotation with the comment
# type: ignoreis a pragmatic approach to dealing with the conditional import of Secret.One suggestion - would it be more readable to use a list comprehension directly in the return statement rather than a temporary list? wdyt?
- secrets = client.list_secrets( - request=secretmanager.ListSecretsRequest( - parent=parent, - filter=filter_string, - ) - ) - return [s for s in secrets] + return list(client.list_secrets( + request=secretmanager.ListSecretsRequest( + parent=parent, + filter=filter_string, + ) + ))
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
poetry.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
airbyte_cdk/cli/airbyte_cdk/_secrets.py(3 hunks)pyproject.toml(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- pyproject.toml
🧰 Additional context used
🪛 GitHub Actions: Linters
airbyte_cdk/cli/airbyte_cdk/_secrets.py
[error] 192-192: mypy: Secret? has no attribute "name" (attr-defined)
[error] 193-193: mypy: Secret? has no attribute "labels" (attr-defined)
[error] 194-194: mypy: Secret? has no attribute "create_time" (attr-defined)
[error] 231-231: mypy: Secret? has no attribute "name" (attr-defined)
[error] 273-273: mypy: Secret? has no attribute "labels" (attr-defined)
[error] 274-274: mypy: Secret? has no attribute "labels" (attr-defined)
⏰ Context from checks skipped due to timeout of 90000ms (8)
- GitHub Check: Check: 'source-pokeapi' (skip=false)
- GitHub Check: Check: 'source-amplitude' (skip=false)
- GitHub Check: Check: 'source-shopify' (skip=false)
- GitHub Check: Check: 'source-hardcoded-records' (skip=false)
- GitHub Check: Pytest (All, Python 3.11, Ubuntu)
- GitHub Check: SDM Docker Image Build
- GitHub Check: Pytest (Fast)
- GitHub Check: Pytest (All, Python 3.10, Ubuntu)
🔇 Additional comments (4)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (4)
92-128: Great modularization of the fetch command!The refactored implementation is much cleaner with helper functions that improve readability and maintainability. Breaking down the process into smaller units of work follows good software engineering principles.
The error handling for when no secrets are found is also a nice touch for better user experience.
237-266: Nice helper for managing the secrets directory!I like the approach of ensuring the secrets directory exists and automatically creating a .gitignore file to prevent accidental commits of secrets. This follows security best practices by making it harder to accidentally leak sensitive information.
279-297: Well-structured client initialization!The function handles both the case when the Google Secret Manager package is not installed and when credentials are not provided. It properly constructs the client from service account info.
A small security note - the error message correctly guides users to set environment variables rather than hardcoding credentials, which is a good security practice.
54-54: Small type ignore commentThe
# type: ignorecomment is a pragmatic solution to handle type checking issues with the help text. It's focused only on the specific line where needed, which is good practice.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (4)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (4)
1-302: Consider addressing 'rich' dependency warningBased on previous review comments, there's a warning about 'rich' being a transitive dependency. Would you consider adding it explicitly to your project dependencies?
In pyproject.toml:
rich = "^13.5.3"Or in setup.py:
install_requires=[ # …, "rich>=13.5.3", ],wdyt?
127-199: 🛠️ Refactor suggestionExcellent addition of the list command!
The new command provides a useful way to view available secrets without downloading them. The rich table with hyperlinks to the GCP console is a great touch for user experience.
However, there might be mypy errors when accessing Secret attributes. Would you consider adding type casting to resolve them? Something like:
- full_secret_name = secret.name + full_secret_name = cast(str, secret.name) # And in the table.add_row: table.add_row( f"[link={secret_url}]{secret_name}[/link]", - "\n".join([f"{k}={v}" for k, v in secret.labels.items()]), - str(secret.create_time), + "\n".join([f"{k}={v}" for k, v in cast(dict, secret.labels).items()]), + str(cast(object, secret.create_time)), )wdyt?
227-236: 🛠️ Refactor suggestionGood extraction of secret writing logic!
The function properly handles writing secrets to files and setting appropriate permissions. However, there's still a potential mypy error related to accessing the
nameattribute. Consider:- version_name = f"{secret.name}/versions/latest" + version_name = f"{cast(str, secret.name)}/versions/latest"wdyt?
269-278: 🛠️ Refactor suggestionClean file path resolution logic!
The function properly handles the case when there's a filename label and falls back to a default. However, there might still be mypy errors related to accessing the
labelsattribute. Consider:- if secret.labels and "filename" in secret.labels: - return secrets_dir / f"{secret.labels['filename']}.json" + labels = cast(dict, getattr(secret, "labels", {})) + if labels and "filename" in labels: + return secrets_dir / f"{labels['filename']}.json"wdyt?
🧹 Nitpick comments (2)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (2)
19-47: Excellent structural improvements with imports!The conditional imports for Google Secret Manager with type annotations are a good approach. It allows for graceful failure handling when dependencies are missing.
However, I notice you're using
# type: ignorein several places. Would a TypeVar approach be more elegant for handling the Secret type? Something like:from typing import TypeVar, cast, Any # Define a generic type for Secret when the module is not loaded SecretType = TypeVar("SecretType", bound=Any) # Use SecretType in type annotations instead of string literals + type: ignorewdyt?
51-51: Minor type annotation fix neededThe type ignore comment works, but it might be better to use an explicit type annotation:
- help=__doc__.replace("\n", "\n\n"), # Render docstring as help text (markdown) # type: ignore + help=str(__doc__).replace("\n", "\n\n"), # Render docstring as help text (markdown)This way you explicitly convert the docstring to string, which should satisfy the type checker without needing to ignore it.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
airbyte_cdk/cli/airbyte_cdk/_secrets.py(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (6)
- GitHub Check: Check: 'source-amplitude' (skip=false)
- GitHub Check: Check: 'source-shopify' (skip=false)
- GitHub Check: Check: 'source-hardcoded-records' (skip=false)
- GitHub Check: Pytest (All, Python 3.11, Ubuntu)
- GitHub Check: Pytest (Fast)
- GitHub Check: Pytest (All, Python 3.10, Ubuntu)
🔇 Additional comments (4)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (4)
89-125: Great refactoring of the fetch command!The restructured approach using helper functions makes the code much more maintainable and easier to understand. Breaking down the operation into logical steps (client creation, connector resolution, directory setup, secret fetching, and writing) improves readability significantly.
I particularly like the clear error message when no secrets are found for a connector.
201-225: Well-structured secret fetching logic!Good implementation of the secret fetching function with proper filtering by connector label. The filter string construction is clean and the type annotations help with understanding the function signature.
I like that you're returning an explicit list comprehension for clarity.
258-265: Good secrets directory setup logic!I like how you've ensured that:
- The secrets directory exists
- A .gitignore file is created to prevent accidental secret commits
This is an important security practice for handling sensitive information.
280-302: Secure credential handling implementation!The client creation function properly:
- Checks for required dependencies
- Verifies environment credentials are present
- Creates the client with appropriate error messaging
This approach keeps sensitive credentials in environment variables rather than hardcoded, which is a security best practice.
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (2)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (2)
282-285: 🛠️ Refactor suggestionUse
castwhen building the version path to avoid type errors, wdyt?- version_name = f"{secret.name}/versions/latest" + version_name = f"{cast(str, getattr(secret, 'name', ''))}/versions/latest"Without this, mypy flags
Secret? has no attribute "name", and runtime may raise when the SDK is unavailable.
323-327: 🛠️ Refactor suggestion
⚠️ Potential issueGuard against missing
labelson the Secret handle, wdyt?
secret.labelscan beNone; dereferencing it unconditionally will blow up. A small refactor also fixes the mypy errors:- if secret.labels and "filename" in secret.labels: - return secrets_dir / f"{secret.labels['filename']}.json" + labels = cast(dict, getattr(secret, "labels", {})) + if "filename" in labels: + return secrets_dir / f"{labels['filename']}.json"
🧹 Nitpick comments (2)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (2)
41-45: Drop the unusednumpy.isinimport to trim dependencies, wdyt?
isinis never referenced in this module. Keeping it:
- Pulls
numpyinto the import graph (large, optional dep).- Triggers linters for “unused import”.
A one-line diff removes the noise:
-from numpy import isin
414-415: Log response text instead of raw bytes for readability (and to fixstr-bytes-safe), wdyt?- logger.error(f"Failed to fetch spec mask: {response.content}") + logger.error("Failed to fetch spec mask: %s", response.text)This avoids the
b'...'prefix and satisfies the linter.🧰 Tools
🪛 GitHub Actions: Linters
[error] 414-414: If x = b'abc' then f"{x}" or "{}".format(x) produces "b'abc'", not "abc". If this is desired behavior, use f"{x!r}" or "{!r}".format(x). Otherwise, decode the bytes [str-bytes-safe]
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
airbyte_cdk/cli/airbyte_cdk/_secrets.py(4 hunks)
🧰 Additional context used
🪛 GitHub Actions: Linters
airbyte_cdk/cli/airbyte_cdk/_secrets.py
[error] 380-380: Missing type parameters for generic type "list" [type-arg]
[error] 414-414: If x = b'abc' then f"{x}" or "{}".format(x) produces "b'abc'", not "abc". If this is desired behavior, use f"{x!r}" or "{!r}".format(x). Otherwise, decode the bytes [str-bytes-safe]
⏰ Context from checks skipped due to timeout of 90000ms (9)
- GitHub Check: Check: 'source-pokeapi' (skip=false)
- GitHub Check: Check: 'source-amplitude' (skip=false)
- GitHub Check: Check: 'source-shopify' (skip=false)
- GitHub Check: Check: 'source-hardcoded-records' (skip=false)
- GitHub Check: Pytest (All, Python 3.11, Ubuntu)
- GitHub Check: Pytest (All, Python 3.10, Ubuntu)
- GitHub Check: Pytest (Fast)
- GitHub Check: Analyze (python)
- GitHub Check: SDM Docker Image Build
aaronsteers
changed the title
secrets list commandsecrets list command and github ci secrets masking
aaronsteers
changed the title
secrets list command and github ci secrets maskingsecrets list CLI command and github ci secrets masking
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (3)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (3)
238-246:Secret.labelsmay beNone, and mypy still complains – shall we cast defensively?Accessing
secret.labels.items()will raiseAttributeErrorwhen labels areNone, and linters keep flaggingattr-defined. We previously discussed usingcast/getattr; the current code still uses direct access. Re-applying that change would address both runtime and static issues. WDYT?
283-285: Same issue forsecret.name– safer withcast
secret.nameis optional when the SDK isn’t installed, so wrapping withcast(str, getattr(secret, "name", ""))preventsAttributeErrorand quells mypy.
324-327:secret.labelsaccess repeats the earlier mypy/runtime riskIf
labelsisNone, the first condition short-circuits, butsecret.labels['filename']will still explode. Moving thelabelsto a local variable viacast(dict, getattr(secret, "labels", {}))avoids this pitfall.
🧹 Nitpick comments (2)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (2)
93-99: Flag already implies bool – can we drop the explicittype=bool?
click.option(..., is_flag=True)automatically makes the parameter abool.
Specifyingtype=boolis redundant and can confuse Click’s help-text (it starts showing[TEXT]instead of a simple flag). WDYT about simplifying?-@click.option( - "--print-ci-secrets-masks", - help="Print GitHub CI mask for secrets.", - type=bool, - is_flag=True, - default=False, -) +@click.option( + "--print-ci-secrets-masks", + help="Print GitHub CI mask for secrets.", + is_flag=True, + default=False, +)
412-419: Network failure in_get_spec_maskwill raise – want a graceful fallback?If the YAML endpoint is unreachable, we log an error but still attempt to parse
response.content, which will raise and abort the CLI. Would it be safer to return an empty list (and thus mask nothing) instead of crashing? Something like:if not response.ok: logger.error(f"Failed to fetch spec mask: {response.content.decode('utf-8')}") - try: - return cast(list[str], yaml.safe_load(response.content)["properties"]) - except Exception as e: - logger.error(f"Failed to parse spec mask: {e}") - raise + return [] + try: + return cast(list[str], yaml.safe_load(response.content)["properties"]) + except Exception as e: + logger.error(f"Failed to parse spec mask: {e}") + return []This keeps the command functional even when offline, at the cost of no masking. WDYT?
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
airbyte_cdk/cli/airbyte_cdk/_secrets.py(4 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (1)
airbyte_cdk/cli/airbyte_cdk/_util.py (2)
resolve_connector_name(46-69)resolve_connector_name_and_directory(8-43)
⏰ Context from checks skipped due to timeout of 90000ms (8)
- GitHub Check: Check: 'source-pokeapi' (skip=false)
- GitHub Check: Check: 'source-amplitude' (skip=false)
- GitHub Check: Check: 'source-shopify' (skip=false)
- GitHub Check: Check: 'source-hardcoded-records' (skip=false)
- GitHub Check: Pytest (All, Python 3.11, Ubuntu)
- GitHub Check: Pytest (All, Python 3.10, Ubuntu)
- GitHub Check: Pytest (Fast)
- GitHub Check: SDM Docker Image Build
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (2)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (2)
320-326:⚠️ Potential issueSame optional-attribute pattern in
_get_secret_filepathFor consistency (and to silence the twin mypy error here), could we apply the same casting?
- if secret.labels and "filename" in secret.labels: - return secrets_dir / f"{secret.labels['filename']}.json" + labels = cast(dict, getattr(secret, "labels", {})) + if labels and "filename" in labels: + return secrets_dir / f"{labels['filename']}.json"This keeps runtime identical and removes the type-checker noise—wdyt?
236-245:⚠️ Potential issuemypy still complains about
Secretattributes – cast to quiet the checker?The earlier bot suggestions haven’t been applied, so
secret.name,secret.labels, andsecret.create_timestill triggerattr-definederrors when the GSM SDK is optional.
Casting keeps runtime behaviour unchanged while satisfying static analysis.- full_secret_name = secret.name + full_secret_name = cast(str, getattr(secret, "name", "")) ... - "\n".join([f"{k}={v}" for k, v in secret.labels.items()]), - str(secret.create_time), + "\n".join([f"{k}={v}" for k, v in cast(dict, getattr(secret, "labels", {})).items()]), + str(getattr(secret, "create_time", "")),Would this adjustment make sense to you?
🧹 Nitpick comments (1)
airbyte_cdk/cli/airbyte_cdk/_secrets.py (1)
407-411: Tiny clean-up: redundant list allocation in_is_secret_property
any([...])eagerly builds a list; the generator expression version is leaner and easier to read:- names_to_mask: list[str] = _get_spec_mask() - if any([mask.lower() in property_name.lower() for mask in names_to_mask]): - return True - - return False + names_to_mask = _get_spec_mask() + return any(mask.lower() in property_name.lower() for mask in names_to_mask)Pure nit—feel free to ignore if you prefer the current style.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
airbyte_cdk/cli/airbyte_cdk/_secrets.py(4 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (9)
- GitHub Check: Check: 'source-pokeapi' (skip=false)
- GitHub Check: Check: 'source-amplitude' (skip=false)
- GitHub Check: Check: 'source-shopify' (skip=false)
- GitHub Check: Check: 'source-hardcoded-records' (skip=false)
- GitHub Check: Pytest (All, Python 3.11, Ubuntu)
- GitHub Check: Analyze (python)
- GitHub Check: Pytest (All, Python 3.10, Ubuntu)
- GitHub Check: SDM Docker Image Build
- GitHub Check: Pytest (Fast)
New
airbyte-cdk secrets listcommand. Prints the secrets that are labeled with the connector name. It also hyperlinks the name of the secret to the google cloud console URL, where you could review versions, update the secret, or review other updates.Note: this command does not download the secret itself - it only gets a handle to the secret, metadata only, and no sensitive data is downloaded. (Use
airbyte-cdk secrets fetchwhen you actually need to download the secrets.)This PR also adds GitHub secrets masking, based on prior logic in the ci_credentials project.
Mousing over a secret name will show the clickable URL:
https://www.loom.com/share/5f04f8ef26634894910a4f38790bd2ff
Summary by CodeRabbit
Summary by CodeRabbit