stacklok / toolhive / 19348357725

push

github

Add environment variable support to header_injection auth (#2574)

Adds header_value_env field to header_injection authentication strategy,
enabling secrets to be resolved from environment variables at config load
time instead of hardcoded in YAML files.

Changes:
- Add header_value_env field to rawHeaderInjectionAuth struct
- Implement validation: exactly one of header_value or header_value_env required
- Update token_exchange and service_account to use env.Reader consistently
- Add 6 comprehensive test cases covering all edge cases
- Update documentation and examples to show both usage patterns

This follows the same pattern as token_exchange (client_secret_env) and
service_account (credentials_env) strategies. Environment variables are
resolved at config load time with fail-fast validation.

Backward compatible: existing header_value (literal) configurations
continue to work unchanged.

Example usage:
  outgoing_auth:
    backends:
      github:
        type: header_injection
        header_injection:
          header_name: "Authorization"
          header_value_env: "GITHUB_API_TOKEN"

Fixes: #2573

16 of 16 new or added lines in 1 file covered. (100.0%)

23489 of 48551 relevant lines covered (48.38%)

36.33 hits per line