fix: harden git secret flow and preserve category label on update#548
Merged
JanakaSandaruwan merged 6 commits intoMay 15, 2026
Merged
Conversation
Signed-off-by: Janaka Sandaruwan <janakasandaruwan1996@gmail.com>
Signed-off-by: Janaka Sandaruwan <janakasandaruwan1996@gmail.com>
JanakaSandaruwan
requested review from
kaviththiranga,
sameerajayasoma and
stefinie123
as code owners
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThis PR removes the deprecated GitSecretField scaffolder, integrates a secret management feature flag into GitSourceField to control secret operations, establishes backend support for secret category labels, and ensures secrets are consistently labeled during creation and their labels are preserved during edits. ChangesSecret Management Refactor
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
plugins/openchoreo/src/components/Secrets/CreateSecretDialog.test.tsx (1)
123-139: 🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick winAdd test coverage for git-credentials category.
The test suite verifies generic category label stamping but lacks coverage for the git-credentials path. Since the PR objectives specifically address git-credentials secret filtering and the dialog code (CreateSecretDialog.tsx lines 418-421) branches on
secretCategory, both paths should be tested.🧪 Proposed test for git-credentials category
}); + + it('stamps the git-credentials label when the category is Git Credentials', async () => { + const user = userEvent.setup(); + const onSubmit = jest.fn().mockResolvedValue({} as any); + renderDialog({ targetPlanes: planes, onSubmit }); + + await user.type(inputForLabel('Secret Name'), 'git-secret'); + await user.click(screen.getByRole('button', { name: /Secret Category/i })); + await user.click(screen.getByRole('option', { name: /Git Credentials/i })); + await user.click(screen.getByRole('radio', { name: /Basic Auth/i })); + await user.type(inputForLabel('Password / Token'), 'ghp_token'); + await user.click(screen.getByRole('button', { name: 'Create' })); + + expect(onSubmit).toHaveBeenCalledTimes(1); + expect(onSubmit.mock.calls[0][0].labels).toEqual({ + 'openchoreo.dev/secret-type': 'git-credentials', + }); + }); });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/openchoreo/src/components/Secrets/CreateSecretDialog.test.tsx` around lines 123 - 139, Add a new test in CreateSecretDialog.test.tsx mirroring the existing "stamps the generic label" test but exercising the git-credentials branch: use renderDialog (same helper), simulate user typing the relevant fields via inputForLabel (e.g., "Secret Name", "Username", "Password / Token"), select the radio labeled "Git Credentials" (or the exact option text used in the dialog), click the Create button, and assert that onSubmit was called once and that onSubmit.mock.calls[0][0].labels equals { 'openchoreo.dev/secret-type': 'git-credentials' }; this ensures the CreateSecretDialog secretCategory branch (CreateSecretDialog.tsx handling for git-credentials) is covered.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@plugins/openchoreo/src/components/Secrets/CreateSecretDialog.test.tsx`:
- Around line 123-139: Add a new test in CreateSecretDialog.test.tsx mirroring
the existing "stamps the generic label" test but exercising the git-credentials
branch: use renderDialog (same helper), simulate user typing the relevant fields
via inputForLabel (e.g., "Secret Name", "Username", "Password / Token"), select
the radio labeled "Git Credentials" (or the exact option text used in the
dialog), click the Create button, and assert that onSubmit was called once and
that onSubmit.mock.calls[0][0].labels equals { 'openchoreo.dev/secret-type':
'git-credentials' }; this ensures the CreateSecretDialog secretCategory branch
(CreateSecretDialog.tsx handling for git-credentials) is covered.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 66e33ae1-7579-4db4-be35-470ab1099ae5
📒 Files selected for processing (12)
packages/app/src/App.tsxpackages/app/src/scaffolder/GitSecretField/GitSecretField.tsxpackages/app/src/scaffolder/GitSecretField/extensions.tspackages/app/src/scaffolder/GitSecretField/index.tspackages/app/src/scaffolder/GitSourceField/GitSourceField.tsxplugins/openchoreo-backend/src/services/SecretsService/SecretsService.tsplugins/openchoreo-common/src/constants.tsplugins/openchoreo-common/src/index.tsplugins/openchoreo/src/components/Secrets/CreateSecretDialog.test.tsxplugins/openchoreo/src/components/Secrets/CreateSecretDialog.tsxplugins/openchoreo/src/components/Secrets/EditSecretDialog.test.tsxplugins/openchoreo/src/components/Secrets/EditSecretDialog.tsx
💤 Files with no reviewable changes (4)
- packages/app/src/scaffolder/GitSecretField/GitSecretField.tsx
- packages/app/src/scaffolder/GitSecretField/index.ts
- packages/app/src/scaffolder/GitSecretField/extensions.ts
- packages/app/src/App.tsx
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
Signed-off-by: Janaka Sandaruwan <janakasandaruwan1996@gmail.com>
Signed-off-by: Janaka Sandaruwan <janakasandaruwan1996@gmail.com>
Signed-off-by: Janaka Sandaruwan <janakasandaruwan1996@gmail.com>
Signed-off-by: Janaka Sandaruwan <janakasandaruwan1996@gmail.com>
stefinie123
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Follow-up to #541. Two issues surfaced after that PR landed:
GET /secretseven when thesecretManagementfeature flag was off, which returned a 500 and showeda user-facing error on a form they couldn't act on. The "Create New Git
Secret" option was also enabled in that state.
EditSecretDialogdid not sendlabelson update. The backend replacesthe full user-set label map on each PUT, so editing a git-credentials
secret silently stripped its
openchoreo.dev/secret-typelabel — afterwhich it no longer appeared in the scaffolder/CI git-secret dropdowns.
Approach
GitSourceFieldreadsuseSecretManagementEnabledand short-circuits the/secretsfetch when the flag is off, so no more spurious 500 errors."Create New Git Secret" is now disabled with a tooltip when the flag is
off or no workflow is selected; the tooltip anchors its left edge to the
option's left edge.
GitSecretFieldscaffolder extension. The CTDconverter never emitted
ui:field: GitSecretField, so it was dead code.GitSecretDialogstays becauseGitSourceFieldstill uses it.CreateSecretDialognow stamps the category label on every new secret —openchoreo.dev/secret-type: genericfor the default Generic categoryand
git-credentialsfor Git Credentials — so the filter logic issymmetric.
SecretsService.getSecretreturns the SecretReference's labels alongsidethe data, and
EditSecretDialogechoes those labels back on PUT soexisting category labels survive value edits. Added a regression test.
Related Issues
N/A
Checklist