1Password SDK Secrets Provider

.github/renovate.json

@@ -6,6 +6,13 @@
     ":dependencyDashboard"
   ],
   "packageRules": [
+    {
+      "description": "Pin SOPS to v3.9.0",
+      "matchPackageNames": [
+        "getsops/sops"
+      ],
+      "allowedVersions": "3.9.0"
+    },
     {
       "description": "Pin GitHub Actions to specific commit SHAs",
       "matchManagers": [

.goreleaser.yaml

@@ -23,6 +23,7 @@ builds:
       - amd64
     ldflags:
       - "-X 'github.com/{{ .Env.GITHUB_REPOSITORY }}/cmd.version={{ .Version }}'"
+      - "-X 'github.com/{{ .Env.GITHUB_REPOSITORY }}/pkg/secrets.version={{ .Version }}'"
       - "-X 'github.com/{{ .Env.GITHUB_REPOSITORY }}/cmd.commitSHA={{ .Env.GITHUB_SHA }}'"
 
 # Archive configuration

.vscode/launch.json

@@ -14,7 +14,7 @@
         "request": "launch",
         "mode": "auto",
         "program": "${workspaceFolder}/cmd/windsor/main.go",
-        "args": ["env", "--verbose"],
+        "args": ["env", "--verbose", "--decrypt"],
         "env": {
           "WINDSOR_SESSION_TOKEN": "local"
         }

aqua.yaml

@@ -6,7 +6,7 @@
 #   enabled: true
 #   require_checksum: true
 #   supported_envs:
-#   - all
+#     - all
 registries:
   - type: standard
     ref: v4.344.0 # renovate: depName=aquaproj/aqua-registry
@@ -18,7 +18,7 @@ packages:
 - name: kubernetes/kubectl@v1.32.3
 - name: go-task/task@v3.42.1
 - name: golang/go@go1.24.2
-- name: getsops/sops@v3.10.1
+- name: getsops/sops@v3.9.0
 - name: abiosoft/colima@v0.8.1
 - name: lima-vm/lima@v1.0.7
 - name: docker/cli@v27.4.1

cmd/env.go

@@ -93,11 +93,6 @@ var envCmd = &cobra.Command{
 			return nil
 		}
 
-		// Set the environment variables internally in the process
-		if err := controller.SetEnvironmentVariables(); err != nil {
-			return fmt.Errorf("Error setting environment variables: %w", err)
-		}
-
 		envPrinters := controller.ResolveAllEnvPrinters()
 		if len(envPrinters) == 0 {
 			if verbose {

cmd/env_test.go

@@ -61,7 +61,7 @@ func setupSafeMocks() *TestMocks {
 	}
 
 	// Set up mock secrets provider
-	mockSecretsProvider := secrets.NewMockSecretsProvider()
+	mockSecretsProvider := secrets.NewMockSecretsProvider(injector)
 	mockController.ResolveAllSecretsProvidersFunc = func() []secrets.SecretsProvider {
 		return []secrets.SecretsProvider{mockSecretsProvider}
 	}
@@ -447,31 +447,6 @@ func TestEnvCmd(t *testing.T) {
 		}
 	})
 
-	t.Run("ErrorResolvingAllEnvPrinters", func(t *testing.T) {
-		defer resetRootCmd()
-
-		// Setup safe mocks
-		mocks := setupSafeMocks()
-
-		// Return empty list for env printers
-		mocks.Controller.ResolveAllEnvPrintersFunc = func() []env.EnvPrinter {
-			return []env.EnvPrinter{}
-		}
-
-		// When the env command is executed with verbose flag
-		rootCmd.SetArgs([]string{"env", "--verbose"})
-		err := Execute(mocks.Controller)
-
-		// Then check the error contents
-		if err == nil {
-			t.Fatalf("Expected an error, got nil")
-		}
-		expectedError := "Error resolving environment printers: no printers returned"
-		if err.Error() != expectedError {
-			t.Fatalf("Expected error %q, got %v", expectedError, err)
-		}
-	})
-
 	t.Run("PrintError", func(t *testing.T) {
 		defer resetRootCmd()
 
@@ -903,7 +878,7 @@ func TestEnvCmd(t *testing.T) {
 			}
 
 			// On any subsequent calls, add a provider
-			mockProvider := secrets.NewMockSecretsProvider()
+			mockProvider := secrets.NewMockSecretsProvider(mocks.Injector)
 			return []secrets.SecretsProvider{mockProvider}
 		}
 
@@ -1231,18 +1206,13 @@ func TestEnvCmd(t *testing.T) {
 			return fmt.Errorf("error setting environment variables")
 		}
 
-		// Run the env command
+		// Run the env command without verbose flag
 		rootCmd.SetArgs([]string{"env"})
 		err := Execute(mocks.Controller)
 
-		// Expect an error
-		if err == nil {
-			t.Fatalf("Expected an error, got nil")
-		}
-
-		expectedError := "Error setting environment variables: error setting environment variables"
-		if err.Error() != expectedError {
-			t.Errorf("Expected error %q, got %q", expectedError, err.Error())
+		// Then the error should be nil and no output should be produced
+		if err != nil {
+			t.Fatalf("Expected error nil, got %v", err)
 		}
 	})
 

cmd/install_test.go

@@ -51,7 +51,7 @@ func setupMockInstallCmdComponents(optionalInjector ...di.Injector) InstallCmdCo
 	injector.Register("configHandler", configHandler)
 
 	// Setup mock secrets provider
-	secretsProvider := secrets.NewMockSecretsProvider()
+	secretsProvider := secrets.NewMockSecretsProvider(injector)
 	controller.ResolveAllSecretsProvidersFunc = func() []secrets.SecretsProvider {
 		return []secrets.SecretsProvider{secretsProvider}
 	}

go.mod

@@ -3,6 +3,7 @@ module github.com/windsorcli/cli
 go 1.23.4
 
 require (
+	github.com/1password/onepassword-sdk-go v0.2.1
 	github.com/abiosoft/colima v0.8.1
 	github.com/aws/smithy-go v1.22.3
 	github.com/briandowns/spinner v1.23.2
@@ -11,7 +12,7 @@ require (
 	github.com/fluxcd/pkg/apis/kustomize v1.9.0
 	github.com/fluxcd/pkg/apis/meta v1.10.0
 	github.com/fluxcd/source-controller/api v1.5.0
-	github.com/getsops/sops/v3 v3.10.1
+	github.com/getsops/sops/v3 v3.9.0
 	github.com/goccy/go-yaml v1.17.1
 	github.com/google/go-jsonnet v0.20.0
 	github.com/hashicorp/hcl/v2 v2.23.0
@@ -38,7 +39,6 @@ require (
 	cloud.google.com/go/monitoring v1.24.1 // indirect
 	cloud.google.com/go/storage v1.51.0 // indirect
 	filippo.io/age v1.2.1 // indirect
-	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
@@ -81,9 +81,11 @@ require (
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
+	github.com/extism/go-sdk v1.7.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fluxcd/pkg/apis/acl v0.6.0 // indirect
@@ -96,6 +98,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.21.1 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -118,6 +121,7 @@ require (
 	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hashicorp/vault/api v1.16.0 // indirect
+	github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -141,6 +145,8 @@ require (
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 // indirect
+	github.com/tetratelabs/wazero v1.8.2 // indirect
 	github.com/urfave/cli v1.22.16 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
@@ -153,6 +159,7 @@ require (
 	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
 	go.opentelemetry.io/otel/trace v1.35.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
 	golang.org/x/mod v0.24.0 // indirect
 	golang.org/x/net v0.39.0 // indirect