differ

Documentation

Overview

Package differ compares two secret sets and reports drift without ever exposing secret values.

Index

• func RenderJSON(r Result) string
• func RenderTable(r Result, opts TableOpts) string
• type Opts
• type Result
  • func Diff(ctx context.Context, a, b Source, opts Opts) (Result, error)
  • func (r Result) HasDrift() bool
• type Snapshot
• type Source
  • func NewDotenvSource(filePath string) Source
  • func NewEnvSource(label string, p provider.SecretProvider, pathPrefix string) Source
  • func NewGitHubSource(owner, repo, token, baseURL string) Source
• type TableOpts

Functions

func RenderJSON

func RenderJSON(r Result) string

RenderJSON produces the machine-readable diff. Never includes secret values.

func RenderTable

func RenderTable(r Result, opts TableOpts) string

RenderTable produces the human-readable diff. Never includes secret values.

Types

type Opts

type Opts struct {
	Hashes bool // compute sha256[:8] per side for changed/unknown keys
}

Opts controls diff computation.

type Result

type Result struct {
	A, B      string
	OnlyA     []string
	OnlyB     []string
	Changed   []string
	Unknown   []string // value comparison impossible (a side is write-only)
	SameCount int
	Hashes    map[string][2]string // key -> {hashA, hashB}; "?" when a side is unreadable
}

Result holds the comparison outcome. It never stores plaintext values.

func Diff

func Diff(ctx context.Context, a, b Source, opts Opts) (Result, error)

Diff compares two sources. Values are read into memory only to compute equality/hashes; they are never stored in Result.

func (Result) HasDrift

func (r Result) HasDrift() bool

HasDrift reports whether the two sources differ in any compared dimension.

type Snapshot

type Snapshot struct {
	Secrets       map[string]string
	CanReadValues bool
}

Snapshot is one source's keys and (optionally readable) values.

type Source

type Source interface {
	Label() string
	Read(ctx context.Context) (Snapshot, error)
}

Source yields a point-in-time snapshot of one secret set.

func NewDotenvSource

func NewDotenvSource(filePath string) Source

NewDotenvSource builds a Source backed by a dotenv file.

func NewEnvSource

func NewEnvSource(label string, p provider.SecretProvider, pathPrefix string) Source

NewEnvSource builds a Source backed by a secret provider and path prefix.

func NewGitHubSource

func NewGitHubSource(owner, repo, token, baseURL string) Source

NewGitHubSource builds a presence-only Source over GitHub Actions repo secrets. baseURL defaults to https://api.github.com when empty.

type TableOpts

type TableOpts struct {
	ShowHash bool
}

TableOpts controls table rendering.