coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: admit existing OpenBao catalog lanes
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source
This commit is contained in:
tegwick 2026-08-21 08:20:33 +02:00
parent 9d383442c8
commit 784be978bf
29 changed files with 1490 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/secrets_engine/handoff.py
View file

@ -13,6 +13,7 @@ from pathlib import Path
from secrets_engine.catalog import CatalogEntry
from secrets_engine.errors import ProvisioningError
from secrets_engine.openbao import OpenBaoClient
from secrets_engine.safe_paths import containing_git_worktree
@dataclass(frozen=True)
@ -27,12 +28,12 @@ class HandoffResult:
def _assert_outside_git_worktree(path: Path) -> Path:
resolved = path.expanduser().resolve()
for parent in (resolved.parent, *resolved.parent.parents):
if (parent / ".git").exists():
raise ProvisioningError(
f"handoff file {resolved} is inside a Git worktree ({parent}); "
"keep AppRole material outside repos"
)
worktree = containing_git_worktree(resolved)
if worktree is not None:
raise ProvisioningError(
f"handoff file {resolved} is inside a Git worktree ({worktree}); "
"keep AppRole material outside repos"
)
return resolved