Add typed environment secret references

decode.go

@@ -76,6 +76,8 @@ func decodeValue(node *document.Node, base reflect.Value, descriptor *typeDescri
 		switch descriptor.kind {
 		case descriptorPointer, descriptorMap, descriptorSlice, descriptorDynamic:
 			return reflect.Zero(descriptor.typeOf), nil
+		case descriptorSecret:
+			return reflect.Value{}, []decodeIssue{newDecodeIssue(CodeSecretRequired, path, node, "required secret reference cannot be null")}
 		default:
 			return reflect.Value{}, []decodeIssue{newDecodeIssue(CodeDecodeNull, path, node, "null is not allowed for this configuration type")}
 		}
@@ -165,6 +167,11 @@ func decodeValue(node *document.Node, base reflect.Value, descriptor *typeDescri
 		result := reflect.New(descriptor.typeOf).Elem()
 		result.SetInt(int64(value))
 		return result, nil
+	case descriptorSecret:
+		if node.Kind != document.String {
+			return typeMismatch(path, node, "secret environment name")
+		}
+		return reflect.ValueOf(SecretEnv(node.Text)), nil
 	case descriptorText:
 		if node.Kind != document.String {
 			return typeMismatch(path, node, "text string")