Fix 1Password multi-vault malfunction

.github/renovate.json

@@ -77,35 +77,15 @@
     {
       "customType": "regex",
       "fileMatch": [
-        "^pkg/constants/constants.go$"
+        "^Dockerfile$",
+        "^.*\\.yaml$",
+        "^.*\\.go$"
       ],
       "matchStrings": [
-        "// renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\n\\s*const\\s+\\S+\\s*=\\s*\"(?<currentValue>[^\"]+)\""
+        "(//|#)\\s*renovate\\s*:\\s*datasource\\s*=\\s*(?<datasource>\\S+)\\s*depName\\s*=\\s*(?<depName>\\S+)\\s*\\n.*?(?<currentValue>v?\\d+\\.\\d+\\.\\d+)"
       ],
       "datasourceTemplate": "{{datasource}}",
       "versioningTemplate": "semver"
-    },
-    {
-      "customType": "regex",
-      "fileMatch": [
-        "^Taskfile.yaml$"
-      ],
-      "matchStrings": [
-        "go install (?<depName>\\S+)@(?<currentValue>\\S+)"
-      ],
-      "datasourceTemplate": "go",
-      "versioningTemplate": "semver"
-    },
-    {
-      "customType": "regex",
-      "fileMatch": [
-        "^Taskfile.yaml$"
-      ],
-      "matchStrings": [
-        "choco install (?<depName>\\S+) --version=(?<currentValue>\\S+)"
-      ],
-      "datasourceTemplate": "chocolatey",
-      "versioningTemplate": "semver"
     }
   ],
   "labels": [

.github/workflows/ci.yaml

@@ -8,9 +8,11 @@ on:
       - 'v[0-9]+.[0-9]+.[0-9]+'
 
 permissions:
-  contents: write  # Allows creating releases
+  contents: write
   issues: read
-  pull-requests: read  
+  pull-requests: read
+  packages: write
+
 jobs:
   build-and-test:
     strategy:
@@ -158,3 +160,64 @@ jobs:
           GPG_FINGERPRINT: ${{ env.GPG_FINGERPRINT }}
           HOMEBREW_CLI_WRITE_PAT: ${{ secrets.HOMEBREW_CLI_WRITE_PAT }}
           GITHUB_SHA: ${{ github.sha }}
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: [build-and-test, sast-scan]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
+      - name: Cache Docker layers
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-docker-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-docker-
+
+      - name: Log in to GitHub Container Registry
+        if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main'
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build Docker image
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        with:
+          context: .
+          push: false
+          tags: ghcr.io/windsorcli/windsorcli:latest
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache
+
+      - name: Push Docker image
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/windsorcli/windsorcli:${{ github.ref_name }}
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache
+
+      - name: Push Docker image latest
+        if: github.ref == 'refs/heads/main'
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/windsorcli/windsorcli:latest
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache

.gitignore

@@ -41,6 +41,7 @@ windsor.yaml
 .windsor/
 .volumes/
 terraform/**/backend_override.tf
+terraform/**/provider_override.tf
 contexts/**/.terraform/
 contexts/**/.tfstate/
 contexts/**/.kube/

.vscode/launch.json

@@ -22,7 +22,12 @@
       "request": "launch",
       "mode": "auto",
       "program": "${workspaceFolder}/cmd/windsor/main.go",
-      "args": ["init", "local"]
+      "args": ["init", "local"],
+      "env": {
+        "WINDSOR_EXEC_MODE": "container",
+        "WINDSOR_CONTEXT": "local",
+        "WINDSOR_PROJECT_ROOT": "${workspaceFolder}"
+      }
     },
     {
       "name": "Windsor Up",
@@ -75,6 +80,19 @@
         "WINDSOR_CONTEXT": "local",
         "WINDSOR_PROJECT_ROOT": "${workspaceFolder}"
       }
+    },
+    {
+      "name": "Windsor Exec",
+      "type": "go",
+      "request": "launch",
+      "mode": "auto",
+      "program": "${workspaceFolder}/cmd/windsor/main.go",
+      "args": ["exec", "--verbose", "--", "sh", "-c", "exit 2"],
+      "env": {
+        "WINDSOR_EXEC_MODE": "container",
+        "WINDSOR_CONTEXT": "local",
+        "WINDSOR_PROJECT_ROOT": "${workspaceFolder}"
+      }
     }
   ]
 }

Dockerfile

@@ -0,0 +1,66 @@
+# Stage 1: Aqua Installer
+# -----------------------
+FROM alpine:3.21.3 AS aqua
+
+# Set environment variables
+ENV PATH="/root/.local/share/aquaproj-aqua/bin:$PATH"
+ENV AQUA_GLOBAL_CONFIG=/etc/aqua/aqua.yaml
+
+# renovate: datasource=github-releases depName=aquaproj/aqua-installer
+ARG AQUA_INSTALLER_VERSION=v3.1.1
+# renovate: datasource=github-releases depName=aquaproj/aqua
+ARG AQUA_VERSION=v2.45.1
+
+# Update package index and install dependencies
+RUN apk update && apk add bash wget --no-cache wget
+
+# Copy aqua configuration
+COPY aqua.docker.yaml /etc/aqua/aqua.yaml
+
+# Install Aqua and tools from aqua.docker.yaml using wget instead of curl
+RUN wget -q https://raw.githubusercontent.com/aquaproj/aqua-installer/${AQUA_INSTALLER_VERSION}/aqua-installer -O aqua-installer && \
+    echo "e9d4c99577c6b2ce0b62edf61f089e9b9891af1708e88c6592907d2de66e3714  aqua-installer" | sha256sum -c - && \
+    chmod +x aqua-installer && \
+    ./aqua-installer -v ${AQUA_VERSION} && \
+    aqua i && \
+    aqua cp -o /dist kubectl talosctl terraform && \
+    rm aqua-installer
+
+# Stage 2: Builder
+# ----------------
+FROM --platform=$BUILDPLATFORM golang:1.24.1-alpine AS builder
+
+# Install dependencies
+RUN apk add --no-cache git
+
+# Build the windsor binary
+COPY . .
+RUN go build -o /work/windsor ./cmd/windsor
+
+# Stage 3: Runtime
+# ----------------
+FROM alpine:3.21.3
+
+# Install runtime dependencies
+RUN apk add --no-cache bash git wget unzip
+
+# Copy tools from aqua-installer
+COPY --from=aqua /dist/* /usr/local/bin/
+
+# Create a non-root user and group
+RUN addgroup -S appgroup && adduser -S windsor -G appgroup
+
+# Switch to windsor user
+USER windsor
+
+# Copy windsor binary
+COPY --from=builder /work/windsor /usr/local/bin/
+
+# Create the .trusted file and add the file pointing to /work
+RUN mkdir -p /home/windsor/.config/windsor && echo "/work" > /home/windsor/.config/windsor/.trusted
+
+# Set working directory
+WORKDIR /work
+
+# Set entrypoint
+ENTRYPOINT ["/usr/local/bin/windsor", "exec", "--"]

api/v1alpha1/aws/aws_config.go

@@ -5,11 +5,11 @@ type AWSConfig struct {
 	// Enabled indicates whether AWS integration is enabled.
 	Enabled *bool `yaml:"enabled,omitempty"`
 
-	// AWSEndpointURL specifies the custom endpoint URL for AWS services.
-	AWSEndpointURL *string `yaml:"aws_endpoint_url,omitempty"`
+	// EndpointURL specifies the custom endpoint URL for AWS services.
+	EndpointURL *string `yaml:"endpoint_url,omitempty"`
 
-	// AWSProfile defines the AWS CLI profile to use for authentication.
-	AWSProfile *string `yaml:"aws_profile,omitempty"`
+	// Profile defines the AWS CLI profile to use for authentication.
+	Profile *string `yaml:"profile,omitempty"`
 
 	// S3Hostname sets the custom hostname for the S3 service.
 	S3Hostname *string `yaml:"s3_hostname,omitempty"`
@@ -19,6 +19,9 @@ type AWSConfig struct {
 
 	// Localstack contains the configuration for Localstack, a local AWS cloud emulator.
 	Localstack *LocalstackConfig `yaml:"localstack,omitempty"`
+
+	// Region specifies the AWS region to use.
+	Region *string `yaml:"region,omitempty"`
 }
 
 // LocalstackConfig represents the Localstack configuration
@@ -32,11 +35,11 @@ func (base *AWSConfig) Merge(overlay *AWSConfig) {
 	if overlay.Enabled != nil {
 		base.Enabled = overlay.Enabled
 	}
-	if overlay.AWSEndpointURL != nil {
-		base.AWSEndpointURL = overlay.AWSEndpointURL
+	if overlay.EndpointURL != nil {
+		base.EndpointURL = overlay.EndpointURL
 	}
-	if overlay.AWSProfile != nil {
-		base.AWSProfile = overlay.AWSProfile
+	if overlay.Profile != nil {
+		base.Profile = overlay.Profile
 	}
 	if overlay.S3Hostname != nil {
 		base.S3Hostname = overlay.S3Hostname
@@ -55,6 +58,9 @@ func (base *AWSConfig) Merge(overlay *AWSConfig) {
 			base.Localstack.Services = overlay.Localstack.Services
 		}
 	}
+	if overlay.Region != nil {
+		base.Region = overlay.Region
+	}
 }
 
 // Copy creates a deep copy of the AWSConfig object
@@ -66,11 +72,11 @@ func (c *AWSConfig) Copy() *AWSConfig {
 	if c.Enabled != nil {
 		copy.Enabled = c.Enabled
 	}
-	if c.AWSEndpointURL != nil {
-		copy.AWSEndpointURL = c.AWSEndpointURL
+	if c.EndpointURL != nil {
+		copy.EndpointURL = c.EndpointURL
 	}
-	if c.AWSProfile != nil {
-		copy.AWSProfile = c.AWSProfile
+	if c.Profile != nil {
+		copy.Profile = c.Profile
 	}
 	if c.S3Hostname != nil {
 		copy.S3Hostname = c.S3Hostname
@@ -87,5 +93,8 @@ func (c *AWSConfig) Copy() *AWSConfig {
 			copy.Localstack.Services = c.Localstack.Services
 		}
 	}
+	if c.Region != nil {
+		copy.Region = c.Region
+	}
 	return copy
 }