feat: allow --tag in infisical secrets set #247
Conversation
|
💬 Discussion in Slack: #pr-review-cli-247-allow-tag-in-infisical-secrets-set Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
mathnogueira
changed the title
--tag in infisical secrets set --tag in infisical secrets set
|
| Filename | Overview |
|---|---|
| packages/models/cli.go | Changed Tag.ID JSON tag from _id to id; risks breaking tag-ID parsing from secret list responses if the API still returns _id for embedded tags |
| packages/util/secrets.go | Adds tag resolution and comparison logic to SetRawSecrets; GetOrCreateTag silently creates project tags on unknown slugs and doesn't deduplicate repeated slug inputs |
| packages/api/api.go | Adds GetTagBySlug and CreateTag API helpers; both use url.PathEscape for path parameters and follow the existing error-handling pattern correctly |
| packages/api/model.go | Adds TagIDs []string to RawSecret, CreateRawSecretV3Request, and UpdateRawSecretByNameV3Request; new SecretTag, GetTagBySlugResponse, CreateTagRequest, CreateTagResponse types look correct |
| packages/cmd/secrets.go | Adds --tag StringArray flag and threads tags slice through to SetRawSecrets; wiring and flag registration look correct |
Comments Outside Diff (1)
-
packages/models/cli.go, line 34-39 (link)Tag.IDJSON field key change may break tag comparisonThe
IDfield was renamed fromjson:"_id"tojson:"id". This struct is consumed byGetRawSecretsV3Response.Secrets[i].Tags(seeapi/model.go:688) to parse tags that are embedded in the secrets list endpoint. Every other entity in this file and inapi/model.gostill usesjson:"_id"(e.g.,SingleEnvironmentVariable.ID,Workspace.ID). If the secrets list endpoint still returns_idfor embedded tag objects, everytag.IDin the new comparison block (existingTagIdsmap) will be an empty string, causing the tags-changed check to always fire — silently triggering an update on everysetcall for an already-tagged secret.
Reviews (1): Last reviewed commit: "fix tag changed condition" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| } | ||
|
|
||
| func GetOrCreateTag(client *resty.Client, projectId string, slug string) (api.SecretTag, error) { | ||
| tag, err := api.GetTagBySlug(client, projectId, slug) | ||
| if err == nil { | ||
| return tag, nil | ||
| } | ||
|
|
||
| var apiErr *api.APIError | ||
| if errors.As(err, &apiErr) { | ||
| if apiErr.StatusCode == http.StatusNotFound { | ||
| newTag, createErr := api.CreateTag(client, projectId, api.CreateTagRequest{ | ||
| Slug: slug, | ||
| Color: "", | ||
| }) | ||
| if createErr != nil { | ||
| return api.SecretTag{}, fmt.Errorf("could not create tag %q: [err=%v]", slug, createErr) | ||
| } | ||
|
|
||
| return newTag, nil | ||
| } | ||
| } | ||
|
|
||
| return api.SecretTag{}, fmt.Errorf("unable to resolve tag slug %q [err=%v]", slug, err) | ||
| } |
There was a problem hiding this comment.
GetOrCreateTag silently creates a new project tag whenever the given slug is not found. A single character typo (e.g. --tag producton) will permanently add a new tag to the project with an empty color string, with no warning to the user. Consider logging an informational message when a tag is created, or returning an error and asking the user to use infisical tags create explicitly.
1 participant
Description 📣
This allows the CLI to create/update a secret via
infisical secrets setand set its tags with--tag.It allows multiple
--tagto be set. Following the same pattern of other tools, if the secret already exists and has tags, providing--tagwill override the existing tags. If no--tagis provided, the existing tags will be preserved.Type ✨
Tests 🛠️
--tagto an existing secret with tags and see that its tags got preserved# Here's some code block to paste some code snippets