Add secrets directory credential resolver

internal/app/run.go

@@ -44,7 +44,16 @@ func runConfig(ctx context.Context, cfg config.Config, options RunOptions) error
 	}
 	summary := runSummary{dryRun: options.DryRun}
 	var failures runFailures
-	backends := newBackendFactory()
+	secretLoad, err := config.LoadSecretEnvironment(cfg.Secrets.Directory, nil)
+	if err != nil {
+		return err
+	}
+	if options.Stdout != nil {
+		if err := writeSecretConflictWarnings(options.Stdout, secretLoad.Conflicts); err != nil {
+			return err
+		}
+	}
+	backends := newBackendFactoryWithEnvironment(secretLoad.Environment)
 	transforms := newTransformRegistry()
 	if options.Stdout != nil {
 		if _, err := fmt.Fprintf(options.Stdout, "Configured pipelines: %d\n", len(cfg.Pipelines)); err != nil {
@@ -205,6 +214,15 @@ func destinationSummary(destinations []config.Destination) string {
 	return strings.Join(ids, ",")
 }
 
+func writeSecretConflictWarnings(w io.Writer, conflicts []config.SecretConflict) error {
+	for _, conflict := range conflicts {
+		if _, err := fmt.Fprintf(w, "Warning: secret %s ignored because the real environment already has that variable\n", conflict.Name); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func writeSSHWarnings(w io.Writer, pipeline config.Pipeline) error {
 	if pipeline.Source.Backend == config.BackendSSH && pipeline.Source.SSH.HostKeyPolicy == config.HostKeyPolicyOff {
 		if _, err := fmt.Fprintf(w, "Warning: pipeline=%s source host_key_policy=off disables SSH host key checking\n", pipeline.ID); err != nil {