skeema / skeema / 25186376878

92%

push

github

password option: support external command shellouts

This commit augments the password option, so that any value wrapped in
`backticks` is treated as an external shell command to execute. As long as the
command exits successfully (code 0), its STDOUT output is captured for use as
the password value. Any leading or trailing whitespace is stripped
automatically.

For example, in whichever .skeema file sets the host option, you could
configure the password to be obtained from AWS Secrets Manager using some
variation of this format:

password=`aws secretsmanager get-secret-value --secret-id SECRET_ID_HERE --query SecretString --output text | jq -r '.password'`

This assumes that `aws` and `jq` are installed and in Skeema's $PATH, and the
password is stored as a secret called "password".

In the backtick-wrapped value, the following placeholder variables are
supported for dynamic interpolation:

  {ENVIRONMENT}: The environment name from the command-line
  {DIRNAME}:     Base name (last path component) of the dir being processed
  {DIRPATH}:     Full path of the dir being processed
  {SCHEMA}:      Schema name being processed, if constant or $ENV
  {USER}:        User name
  {HOST}:        Host name
  {PORT}:        Port number of host

These variables are useful if you have many hosts with different passwords.
For example, you could pass {HOST} to the command-line to dynamically indicate
which database server hostname you need to obtain the password for.

Note that for {DIRNAME} and {DIRPATH}, the "dir being processed" means
whichever subdir requires a database connection to be made. This is typically
a directory that set the schema option, NOT necessarily whichever directory
set the password option. This behavior allows you to set a generic command-
line in a global or top-level config file, and reuse it across many subdirs.

Internally, Skeema caches passwords in memory to avoid duplicate runs of the
exact same external command-line (after variable inte... (continued)

137 of 146 new or added lines in 6 files covered. (93.84%)

10925 of 11811 relevant lines covered (92.5%)

1.11 hits per line