Add typed environment secret references

validation.go

@@ -96,7 +96,7 @@ func (v *Validation) report(severity Severity, path Path, message string, relate
 	v.state.diagnostics = append(v.state.diagnostics, diagnostic)
 }
 
-func runValidation[T any](configuration *T, validator func(*T, *Validation), schema *schemaDescriptor, before, input *document.Node) []Diagnostic {
+func runValidation[T any](configuration *T, validator func(*T, *Validation), schema *schemaDescriptor, before, input *document.Node, lookups map[string]secretLookupResult) []Diagnostic {
 	state := &validationState{
 		active: true, errorCode: CodeValidateError, warningCode: CodeValidateWarning,
 		invalidPath: CodeValidateInvalidPath, schema: schema, document: input,
@@ -112,6 +112,9 @@ func runValidation[T any](configuration *T, validator func(*T, *Validation), sch
 	for _, delta := range compareDocumentTrees(before, after) {
 		state.diagnostics = append(state.diagnostics, validationMutationDiagnostic(delta.path))
 	}
+	for _, path := range changedSecretStates(reflect.ValueOf(*configuration), schema.root, lookups) {
+		state.diagnostics = append(state.diagnostics, validationMutationDiagnostic(path))
+	}
 	return canonicalDiagnostics(state.diagnostics)
 }