fix(secrets): validate redactor config based on added key count

.github/workflows/proto.yml

@@ -8,10 +8,12 @@ on:
   workflow_dispatch:
 
 jobs:
-  proto:
+  settings:
     runs-on: ubuntu-latest
-    env:
-      PROTO_ENABLED: true
+    outputs:
+      go_version: ${{ steps.settings.outputs.go_version }}
+      buf_version: ${{ steps.settings.outputs.buf_version }}
+      proto_enabled: ${{ steps.settings.outputs.proto_enabled }}
     steps:
       - uses: actions/checkout@v6
       - name: Load project settings
@@ -22,25 +24,27 @@ jobs:
           set +a
           echo "go_version=${GO_VERSION}" >> "$GITHUB_OUTPUT"
           echo "buf_version=${BUF_VERSION}" >> "$GITHUB_OUTPUT"
-          echo "PROTO_ENABLED=${PROTO_ENABLED:-true}" >> "$GITHUB_ENV"
+          echo "proto_enabled=${PROTO_ENABLED:-true}" >> "$GITHUB_OUTPUT"
+  proto:
+    runs-on: ubuntu-latest
+    needs: settings
+    if: needs.settings.outputs.proto_enabled == 'true'
+    steps:
+      - uses: actions/checkout@v6
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: "${{ steps.settings.outputs.go_version }}"
+          go-version: "${{ needs.settings.outputs.go_version }}"
           check-latest: true
       - name: Setup buf
         uses: bufbuild/buf-setup-action@v1
         with:
-          version: "${{ steps.settings.outputs.buf_version }}"
+          version: "${{ needs.settings.outputs.buf_version }}"
       - name: Lint protos
-        if: env.PROTO_ENABLED != 'false'
         run: buf lint
       - name: Format protos
-        if: env.PROTO_ENABLED != 'false'
         run: buf format -w
       - name: Generate protos
-        if: env.PROTO_ENABLED != 'false'
         run: buf generate
       - name: Check diff
-        if: env.PROTO_ENABLED != 'false'
         run: git diff --exit-code

cspell.json

@@ -121,8 +121,10 @@
     "mlock",
     "mvdan",
     "MX",
+    "mykey",
     "myproject",
     "mypy",
+    "mysecret",
     "myuser",
     "nbf",
     "nethtml",

pkg/encoding/encoding_test.go

@@ -154,6 +154,7 @@ func TestDecodeJSONReader(t *testing.T) {
 	reader := strings.NewReader(`{"name":"alpha"}`)
 
 	var result payload
+
 	err := DecodeJSONReader(reader, &result)
 	if err != nil {
 		t.Fatalf("expected decoded, got %v", err)

pkg/secrets/redact.go

@@ -85,16 +85,21 @@ func WithRedactionKeys(keys ...string) RedactorOption {
 			cfg.keys = make(map[string]struct{})
 		}
 
+		addedCount := 0
+
 		for _, key := range keys {
 			value := normalizeRedactionKey(key)
 			if value == "" {
 				continue
 			}
 
-			cfg.keys[value] = struct{}{}
+			if _, exists := cfg.keys[value]; !exists {
+				cfg.keys[value] = struct{}{}
+				addedCount++
+			}
 		}
 
-		if len(cfg.keys) == 0 {
+		if addedCount == 0 {
 			return ErrInvalidRedactorConfig
 		}