Repository navigation
feat(credential): implement the secret process (#7882) - #358
Merged
Merged
Conversation
Gabriel Pezé (gabriel-peze)
changed the title
6 tasks
Gabriel Pezé (gabriel-peze)
force-pushed
the
issue/7882
branch
from
October 9, 2026 13:16
46d09df to
af95d81
Compare
Member
|
The implementation have been done and tested in both stratus (OpenAEV-Platform/injectors#472) and prowler (OpenAEV-Platform/injectors#471). I've added a selector 'credentials' to the contract, allowing to switch from the new creds manager to the old manual way: 
i've created a creds for aws: and tested it in various prowler contracts: and it works: |
Gaetan Santucci (GaetanSantucci)
marked this pull request as ready for review
October 14, 2026 16:22
There was a problem hiding this comment.
🟡 Changes recommended
Redirects can disclose authorisation codes, and malformed inputs can bypass validation or error mapping.
3 open findings
What changed in this PR
Adds execution-time credential resolution to the Python client, converting platform secrets into cloud-specific environment variables and temporary files.
Changes:
- Adds attachment resolution, typed secrets, compatibility checks, and error mapping.
- Adds AWS, Azure, and GCP credential materialization with temporary-file cleanup.
- Tests resolution, validation, materialization, and secret redaction.
| File | Description |
|---|---|
| test/credential/test_credential_resolved.py | Tests secret parsing and compatibility. |
| test/credential/test_credential_materializer.py | Tests cloud outputs and cleanup. |
| test/credential/test_credential_errors.py | Tests error codes and guidance. |
| test/credential/test_credential_attachment.py | Tests attachment parsing and resolution. |
| test/apis/inject/test_inject.py | Tests secret-resolution requests and failures. |
| test/apis/inject/__init__.py | Adds the test package marker. |
| pyoaev/credential/types.py | Defines secret-related enums. |
| pyoaev/credential/resolved.py | Adds typed secrets and validation. |
| pyoaev/credential/materializer.py | Generates cloud environments and temporary files. |
| pyoaev/credential/errors.py | Defines credential errors and operator guidance. |
| pyoaev/credential/attachment.py | Resolves job credential attachments. |
| pyoaev/credential/__init__.py | Exports credential APIs. |
| pyoaev/apis/inject.py | Adds the secret-resolution endpoint method. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # The error is raised outside of the except blocks so the original | ||
| # exception, which holds the response body, is not chained to it. | ||
| try: | ||
| result = self.openaev.http_post(path, post_data=data, **kwargs) |
Comment on lines
+63
to
+64
| if not references: | ||
| return None |
| ``CREDENTIAL_RESOLUTION_UNAVAILABLE``. Any other failure falls back to | ||
| ``CREDENTIAL_ACCESS_DENIED`` so that nothing about the credential leaks. | ||
| """ | ||
| if error_message: |
…ures to unavailable (#7882)
Gabriel Pezé (gabriel-peze)
force-pushed
the
issue/7882
branch
from
October 19, 2026 08:37
072ab48 to
35d41d3
Compare
Christophe Melchior (Kakudou)
approved these changes
Oct 26, 2026
Christophe Melchior (Kakudou)
left a comment
Christophe Melchior (Kakudou)
left a comment
Member
There was a problem hiding this comment.
LGTM, ty for tho work done on that credentials feature ;)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Related issues
Checklist