stacklok / toolhive / 19900287993

59%

Build Type

push

github

Committed by web-flow

Commit Message

Add --from-secret and --from-env flags to set-build-env (#2860)

Implement secure credential handling for build environment variables
during protocol builds (npx://, uvx://, go://). This allows users to
reference ToolHive secrets or shell environment variables instead of
storing sensitive values in the configuration file.

New features:
- `--from-secret`: Reference a ToolHive secret by name, validated at
  configuration time, resolved at build time
- `--from-env`: Read value from shell environment at build time

Configuration model:
- BuildEnvFromSecrets: maps env var names to secret names
- BuildEnvFromShell: list of env var names to read from shell

Security:
- No sensitive values stored in config file
- Secret values validated against dangerous characters
- Multi-stage builds ensure credentials don't leak to final image

Example usage:
  thv secret set npm-registry "https://:token@npm.corp.example.com"
  thv config set-build-env --from-secret NPM_CONFIG_REGISTRY npm-registry
  thv config set-build-env --from-env GITHUB_TOKEN

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

Run Details

120 of 449 new or added lines in 5 files covered. (26.73%)

7 existing lines in 3 files now uncovered.

26168 of 52408 relevant lines covered (49.93%)

57.11 hits per line