Preserve secret sensitivity across sibling inheritance

internal/engine/secret.go

@@ -34,6 +34,35 @@ func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, me
 			}
 		}
 	}
+	var inherited []secretDependency
+	for _, operation := range metadata.inheritance {
+		if operation.control != nil {
+			control := operation.control.path
+			paths[control.String()] = control.clone()
+			for _, contributor := range operation.controlOrigin.contributors {
+				paths[contributor.source.String()] = contributor.source.clone()
+				inherited = append(inherited, secretDependency{target: control.clone(), dependency: contributor.source.clone()})
+			}
+			continue
+		}
+		if operation.transfer == nil {
+			continue
+		}
+		for pointer := range operation.parentOrigins {
+			source, err := ParsePath(pointer)
+			if err != nil {
+				continue
+			}
+			relative, ok := relativeHistoryPath(operation.transfer.from, source)
+			if !ok {
+				continue
+			}
+			destination := appendInheritancePath(operation.transfer.to, relative)
+			paths[pointer] = source
+			paths[destination.String()] = destination.clone()
+			inherited = append(inherited, secretDependency{target: destination, dependency: source})
+		}
+	}
 
 	secret := make(map[string]bool)
 	for _, tree := range append(projections, final) {
@@ -62,6 +91,16 @@ func classifySecretPaths(schema *schemaDescriptor, predicate func(Path) bool, me
 				changed = true
 			}
 		}
+		for _, link := range inherited {
+			if pathIsSecret(secret, link.dependency) && !secret[link.target.String()] {
+				secret[link.target.String()] = true
+				changed = true
+			}
+			if pathIsSecret(secret, link.target) && !secret[link.dependency.String()] {
+				secret[link.dependency.String()] = true
+				changed = true
+			}
+		}
 		if !changed {
 			return secret
 		}