🔐 Add secret subcommand

.github/workflows/ci.yaml

@@ -19,7 +19,12 @@ jobs:
 
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+
+      - name: 🔵 Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: 1.25.x
 
       - uses: pre-commit/[email protected]
 
@@ -37,12 +42,12 @@ jobs:
 
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: 🔵 Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: 1.25.x
 

.github/workflows/tag.yaml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 📥 Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: 🔢 Extract version from version.go
         id: extract_version

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: check-added-large-files
         args:
@@ -12,6 +12,6 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/golangci/golangci-lint
-    rev: v2.4.0
+    rev: v2.7.2
     hooks:
       - id: golangci-lint-fmt

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 KloudKIT
+Copyright (c) 2026 KloudKIT
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

cmd/feature/feature.go

@@ -1,6 +1,7 @@
 package feature
 
 import (
+	"github.com/kloudkit/ws-cli/internals/config"
 	"github.com/kloudkit/ws-cli/internals/env"
 	"github.com/spf13/cobra"
 )
@@ -13,7 +14,7 @@ var FeatureCmd = &cobra.Command{
 func init() {
 	FeatureCmd.PersistentFlags().String(
 		"root",
-		env.String("WS_FEATURES_DIR", "/features"),
+		env.String(config.EnvFeaturesDir, config.DefaultFeaturesDir),
 		"Root directory of additional features",
 	)
 

cmd/info/info.go

@@ -1,20 +1,21 @@
 package info
 
 import (
+	"encoding/json"
 	"fmt"
 	"io"
+	"os"
+	"strings"
 
-	"encoding/json"
+	"github.com/kloudkit/ws-cli/internals/config"
 	"github.com/kloudkit/ws-cli/internals/styles"
 	"github.com/spf13/cobra"
-	"os"
-	"strings"
 )
 
 func readJsonFile() map[string]any {
 	var content map[string]any
 
-	data, _ := os.ReadFile("/var/lib/workspace/manifest.json")
+	data, _ := os.ReadFile(config.DefaultManifestPath)
 
 	_ = json.Unmarshal(data, &content)
 

cmd/info/version.go

@@ -1,3 +1,3 @@
 package info
 
-var Version = "0.0.35"
+var Version = "0.0.36"

cmd/log/log_test.go

@@ -9,90 +9,92 @@ import (
 	"gotest.tools/v3/assert"
 )
 
-func TestWarnCommandInvokesLogWithFlags(t *testing.T) {
-	var gotLevel, gotMsg string
-	var gotIndent int
-	var gotStamp bool
-	called := 0
+func TestLogCommand(t *testing.T) {
+	t.Run("WarnInvokesLogWithFlags", func(t *testing.T) {
+		var gotLevel, gotMsg string
+		var gotIndent int
+		var gotStamp bool
+		called := 0
 
-	original := logger.Log
-	logger.Log = func(w io.Writer, level, message string, indent int, withStamp bool) {
-		called++
-		gotLevel = level
-		gotMsg = message
-		gotIndent = indent
-		gotStamp = withStamp
-	}
-	defer func() { logger.Log = original }()
+		original := logger.Log
+		logger.Log = func(w io.Writer, level, message string, indent int, withStamp bool) {
+			called++
+			gotLevel = level
+			gotMsg = message
+			gotIndent = indent
+			gotStamp = withStamp
+		}
+		defer func() { logger.Log = original }()
 
-	buffer := new(bytes.Buffer)
-	cmd := LogCmd
-	cmd.SetOut(buffer)
-	cmd.SetArgs([]string{"warn", "hello", "--indent", "2", "--stamp"})
+		buffer := new(bytes.Buffer)
+		cmd := LogCmd
+		cmd.SetOut(buffer)
+		cmd.SetArgs([]string{"warn", "hello", "--indent", "2", "--stamp"})
 
-	err := cmd.Execute()
-	assert.NilError(t, err)
-	assert.Equal(t, 1, called)
-	assert.Equal(t, "warn", gotLevel)
-	assert.Equal(t, "hello", gotMsg)
-	assert.Equal(t, 2, gotIndent)
-	assert.Assert(t, gotStamp)
-}
+		err := cmd.Execute()
+		assert.NilError(t, err)
+		assert.Equal(t, 1, called)
+		assert.Equal(t, "warn", gotLevel)
+		assert.Equal(t, "hello", gotMsg)
+		assert.Equal(t, 2, gotIndent)
+		assert.Assert(t, gotStamp)
+	})
 
-func TestInfoCommandUsesPipeWhenFlagged(t *testing.T) {
-	var gotLevel string
-	var gotIndent int
-	var gotStamp bool
-	called := 0
+	t.Run("InfoUsesPipeWhenFlagged", func(t *testing.T) {
+		var gotLevel string
+		var gotIndent int
+		var gotStamp bool
+		called := 0
 
-	original := logger.Pipe
-	logger.Pipe = func(r io.Reader, w io.Writer, level string, indent int, withStamp bool) {
-		called++
-		gotLevel = level
-		gotIndent = indent
-		gotStamp = withStamp
-	}
-	defer func() { logger.Pipe = original }()
+		original := logger.Pipe
+		logger.Pipe = func(r io.Reader, w io.Writer, level string, indent int, withStamp bool) {
+			called++
+			gotLevel = level
+			gotIndent = indent
+			gotStamp = withStamp
+		}
+		defer func() { logger.Pipe = original }()
 
-	cmd := LogCmd
-	cmd.SetIn(bytes.NewBufferString("foo\n"))
-	cmd.SetOut(new(bytes.Buffer))
-	cmd.SetArgs([]string{"info", "--pipe", "--indent", "1", "--stamp"})
+		cmd := LogCmd
+		cmd.SetIn(bytes.NewBufferString("foo\n"))
+		cmd.SetOut(new(bytes.Buffer))
+		cmd.SetArgs([]string{"info", "--pipe", "--indent", "1", "--stamp"})
 
-	err := cmd.Execute()
-	assert.NilError(t, err)
-	assert.Equal(t, 1, called)
-	assert.Equal(t, "info", gotLevel)
-	assert.Equal(t, 1, gotIndent)
-	assert.Assert(t, gotStamp)
-}
+		err := cmd.Execute()
+		assert.NilError(t, err)
+		assert.Equal(t, 1, called)
+		assert.Equal(t, "info", gotLevel)
+		assert.Equal(t, 1, gotIndent)
+		assert.Assert(t, gotStamp)
+	})
 
-func TestStampCommandInvokesLog(t *testing.T) {
-	called := 0
-	var gotLevel, gotMsg string
-	var gotIndent int
-	var gotStamp bool
+	t.Run("StampInvokesLog", func(t *testing.T) {
+		called := 0
+		var gotLevel, gotMsg string
+		var gotIndent int
+		var gotStamp bool
 
-	original := logger.Log
-	logger.Log = func(w io.Writer, level, message string, indent int, withStamp bool) {
-		called++
-		gotLevel = level
-		gotMsg = message
-		gotIndent = indent
-		gotStamp = withStamp
-	}
-	defer func() { logger.Log = original }()
+		original := logger.Log
+		logger.Log = func(w io.Writer, level, message string, indent int, withStamp bool) {
+			called++
+			gotLevel = level
+			gotMsg = message
+			gotIndent = indent
+			gotStamp = withStamp
+		}
+		defer func() { logger.Log = original }()
 
-	cmd := LogCmd
-	cmd.PersistentFlags().Set("pipe", "false")
-	cmd.SetOut(new(bytes.Buffer))
-	cmd.SetArgs([]string{"stamp"})
+		cmd := LogCmd
+		cmd.PersistentFlags().Set("pipe", "false")
+		cmd.SetOut(new(bytes.Buffer))
+		cmd.SetArgs([]string{"stamp"})
 
-	err := cmd.Execute()
-	assert.NilError(t, err)
-	assert.Equal(t, 1, called)
-	assert.Equal(t, "", gotLevel)
-	assert.Equal(t, "", gotMsg)
-	assert.Equal(t, 0, gotIndent)
-	assert.Assert(t, gotStamp)
+		err := cmd.Execute()
+		assert.NilError(t, err)
+		assert.Equal(t, 1, called)
+		assert.Equal(t, "", gotLevel)
+		assert.Equal(t, "", gotMsg)
+		assert.Equal(t, 0, gotIndent)
+		assert.Assert(t, gotStamp)
+	})
 }

cmd/root.go

@@ -10,6 +10,7 @@ import (
 	"github.com/kloudkit/ws-cli/cmd/info"
 	"github.com/kloudkit/ws-cli/cmd/log"
 	"github.com/kloudkit/ws-cli/cmd/logs"
+	"github.com/kloudkit/ws-cli/cmd/secrets"
 	"github.com/kloudkit/ws-cli/cmd/serve"
 	"github.com/kloudkit/ws-cli/cmd/show"
 	"github.com/kloudkit/ws-cli/cmd/template"
@@ -49,5 +50,6 @@ func init() {
 		info.InfoCmd,
 		log.LogCmd,
 		logs.LogsCmd,
+		secrets.SecretsCmd,
 	)
 }

cmd/secrets/decrypt.go

@@ -0,0 +1,57 @@
+package secrets
+
+import (
+	"fmt"
+
+	"github.com/kloudkit/ws-cli/internals/io"
+	internalSecrets "github.com/kloudkit/ws-cli/internals/secrets"
+	"github.com/kloudkit/ws-cli/internals/styles"
+	"github.com/spf13/cobra"
+)
+
+var decryptCmd = &cobra.Command{
+	Use:   "decrypt <encrypted>",
+	Short: "Decrypt an encrypted value",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		input := args[0]
+		outputFile, _ := cmd.Flags().GetString("output")
+		masterKeyFlag, _ := cmd.Flags().GetString("master")
+		modeStr, _ := cmd.Flags().GetString("mode")
+		force, _ := cmd.Flags().GetBool("force")
+		raw, _ := cmd.Flags().GetBool("raw")
+
+		masterKey, err := internalSecrets.ResolveMasterKey(masterKeyFlag)
+		if err != nil {
+			return err
+		}
+
+		encryptedBytes, err := internalSecrets.DecodeWithPrefix(input)
+		if err != nil {
+			return err
+		}
+
+		decrypted, err := internalSecrets.Decrypt(string(encryptedBytes), masterKey)
+		if err != nil {
+			return err
+		}
+
+		if outputFile == "" {
+			fmt.Fprint(cmd.OutOrStdout(), string(decrypted))
+			return nil
+		}
+
+		if err := io.WriteSecureFile(outputFile, decrypted, modeStr, force); err != nil {
+			return err
+		}
+
+		if !raw {
+			fmt.Fprintln(cmd.OutOrStdout(), styles.Success().Render(fmt.Sprintf("Decrypted value written to %s", outputFile)))
+		}
+		return nil
+	},
+}
+
+func init() {
+	decryptCmd.Flags().String("output", "", "Write output to file instead of stdout")
+}