Add indexed secret dependency closure

internal/engine/secret_propagation.go

@@ -0,0 +1,69 @@
+package engine
+
+type secretTrigger struct {
+	target   string
+	ordinary bool
+}
+
+func closeSecretDependencies(paths map[string]Path, sensitive map[string]bool, dependencies, inherited []secretDependency) map[string]bool {
+	result := make(map[string]bool, len(sensitive))
+	queue := make([]string, 0, len(sensitive))
+	for pointer, classified := range sensitive {
+		if classified {
+			result[pointer] = true
+			queue = append(queue, pointer)
+		}
+	}
+
+	var triggers pathPrefixIndex
+	triggerValues := make([]secretTrigger, 0, len(dependencies)+2*len(inherited))
+	insert := func(dependency Path, target string, ordinary bool) {
+		if ordinary && !dependency.valid() {
+			return
+		}
+		id := len(triggerValues)
+		triggerValues = append(triggerValues, secretTrigger{target: target, ordinary: ordinary})
+		triggers.insert(dependency.String(), id)
+	}
+	for _, dependency := range dependencies {
+		insert(dependency.dependency, dependency.target.String(), true)
+	}
+	for _, link := range inherited {
+		insert(link.dependency, link.target.String(), false)
+		insert(link.target, link.dependency.String(), false)
+	}
+
+	fired := make([]bool, len(triggerValues))
+	activate := func(id int) {
+		if fired[id] {
+			return
+		}
+		fired[id] = true
+		target := triggerValues[id].target
+		if !result[target] {
+			result[target] = true
+			queue = append(queue, target)
+		}
+	}
+	for head := 0; head < len(queue); head++ {
+		pointer := queue[head]
+		if classified, ok := paths[pointer]; ok && classified.valid() {
+			triggers.visitAncestors(classified.String(), func(id int) {
+				if triggerValues[id].ordinary {
+					activate(id)
+				}
+			})
+			triggers.visitDescendants(classified.String(), func(id int) {
+				if triggerValues[id].ordinary {
+					activate(id)
+				}
+			})
+		}
+		triggers.visitDescendants(pointer, func(id int) {
+			if !triggerValues[id].ordinary {
+				activate(id)
+			}
+		})
+	}
+	return result
+}