Bootstrap secrets before configuration loading

internal/app/secrets_bootstrap.go

@@ -0,0 +1,66 @@
+package app
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+type secretsBootstrap struct {
+	selection    *string
+	selectionSet bool
+	called       bool
+}
+
+func (b *secretsBootstrap) load(pipelinePath string, loader func(string) (*configkit.SecretsReport, error)) error {
+	if b == nil || b.called {
+		return nil
+	}
+	b.called = true
+	directory, required, err := selectedSecretsDirectory(pipelinePath, b.selection)
+	if err != nil {
+		return err
+	}
+	if !required {
+		if _, err := os.Stat(directory); errors.Is(err, os.ErrNotExist) {
+			return nil
+		} else if err != nil {
+			return fmt.Errorf("inspect conventional secrets directory %q: %w", directory, err)
+		}
+	}
+	report, loadErr := loader(directory)
+	if loadErr == nil {
+		return nil
+	}
+	var rendered bytes.Buffer
+	if report != nil {
+		_, _ = report.WriteTo(&rendered)
+	}
+	if rendered.Len() != 0 {
+		return fmt.Errorf("bootstrap secrets directory: %w\n%s", loadErr, strings.TrimSpace(rendered.String()))
+	}
+	return fmt.Errorf("bootstrap secrets directory: %w", loadErr)
+}
+
+func selectedSecretsDirectory(pipelinePath string, selection *string) (string, bool, error) {
+	if selection != nil {
+		if strings.TrimSpace(*selection) == "" {
+			return "", true, fmt.Errorf("--secrets-dir requires a non-empty path")
+		}
+		path, err := filepath.Abs(*selection)
+		if err != nil {
+			return "", true, fmt.Errorf("resolve --secrets-dir %q: %w", *selection, err)
+		}
+		return filepath.Clean(path), true, nil
+	}
+	root, err := filepath.Abs(pipelinePath)
+	if err != nil {
+		return "", false, fmt.Errorf("resolve pipeline path for secrets discovery: %w", err)
+	}
+	return filepath.Join(filepath.Dir(root), "secrets"), false, nil
+}