feat(secret): add secret module with datastore, env, aws and gcp providers

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# Lines starting with '#' are comments.
+# Each line is a file pattern followed by one or more owners.
+
+# These owners will be the default owners for everything in the repo.
+*       @galaxy-io/galaxy

.github/workflows/ci.yaml

@@ -0,0 +1,49 @@
+name: "CI"
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  go:
+    # Release Please PRs only bump versions; skipped checks still satisfy the ruleset.
+    if: github.event.pull_request.user.login != 'gx-null[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: .go-version
+          cache-dependency-path: "**/go.sum"
+
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        with:
+          version: v2.15.0
+          install-only: true
+
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
+
+      # Modules build against each other's working copies, not their tags.
+      - name: Workspace
+        run: just work
+
+      - name: Tidy
+        run: just tidy check
+
+      - name: Format
+        run: just format check
+
+      - name: Lint
+        run: just lint check
+
+      - name: Test
+        run: just test

.github/workflows/pr-title.yaml

@@ -0,0 +1,18 @@
+name: "PR Title"
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  conventional:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # Squash merges land the title as the commit, which release-please reads.
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-please.yaml

@@ -0,0 +1,29 @@
+name: "Release Please"
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-please
+  cancel-in-progress: false
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # Tags pushed with the default token do not trigger other workflows; the
+      # app's do.
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ secrets.GX_NULL_APP_ID }}
+          private-key: ${{ secrets.GX_NULL_PRIVATE_KEY }}
+
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}

.gitignore

@@ -0,0 +1,2 @@
+go.work
+go.work.sum

.go-version

@@ -0,0 +1 @@
+1.26.4

.golangci.yaml

@@ -0,0 +1,90 @@
+version: "2"
+
+run:
+  timeout: 10m
+  modules-download-mode: readonly
+
+formatters:
+  enable:
+    - gofumpt
+    - goimports
+
+  settings:
+    gofumpt:
+      extra:
+        group-params: true
+
+    goimports:
+      local-prefixes:
+        - github.com/galaxy-io/modules
+
+linters:
+  enable:
+    # Bugs
+    - staticcheck
+    - gosec
+    - errcheck
+    - govet
+
+    # Performance
+    - prealloc
+    - ineffassign
+
+    # Style
+    - gocritic
+    - revive
+    - misspell
+
+    # Complexity
+    - gocyclo
+    - funlen
+
+    # Unused code
+    - unused
+    - unparam
+
+  settings:
+    gocritic:
+      enabled-tags:
+        - diagnostic
+        - style
+        - performance
+      disabled-checks:
+        - hugeParam
+        - rangeValCopy
+        - unnamedResult
+
+    revive:
+      rules:
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: error-return
+        - name: error-strings
+        - name: error-naming
+        - name: exported
+        - name: increment-decrement
+        - name: var-naming
+        - name: range
+        - name: receiver-naming
+        - name: time-naming
+        - name: unexported-return
+        - name: indent-error-flow
+        - name: errorf
+
+    gocyclo:
+      min-complexity: 30
+
+    funlen:
+      lines: 100
+      statements: 60
+
+    gosec:
+      excludes:
+        - G104
+        - G304
+
+  exclusions:
+    paths:
+      - ".*_test\\.go"
+      - ".*\\.pb\\.go"

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  "secret": "0.0.0"
+}

README.md

@@ -1 +1,27 @@
-# modules
+# galaxy-io/modules
+
+[![CI](https://github.com/galaxy-io/modules/actions/workflows/ci.yaml/badge.svg)](https://github.com/galaxy-io/modules/actions/workflows/ci.yaml)
+
+Shared Go building blocks for Galaxy apps. Each module is versioned on its own.
+
+| Module | Description | |
+| --- | --- | --- |
+| [`secret`](secret) | Resolves secret refs to values, scoped per tenant. | [![Go Reference](https://pkg.go.dev/badge/github.com/galaxy-io/modules/secret.svg)](https://pkg.go.dev/github.com/galaxy-io/modules/secret) [![Version](https://img.shields.io/github/v/tag/galaxy-io/modules?filter=secret/*&label=version)](https://github.com/galaxy-io/modules/tags) |
+
+## Install
+
+```sh
+go get github.com/galaxy-io/modules/{name}@latest
+```
+
+## Development
+
+Install Go, [`just`](https://github.com/casey/just), and [`golangci-lint`](https://golangci-lint.run), then:
+
+```sh
+just work
+just tidy
+just format
+just lint
+just test
+```

justfile

@@ -0,0 +1,51 @@
+default:
+    @just --list
+
+# run cmd in every Go module
+_each cmd:
+    for dir in $(find . -name go.mod -exec dirname {} \;); do (cd "$dir" && {{ cmd }}) || exit 1; done
+
+# write the gitignored go.work: every module, with each version one module requires of another replaced by its local copy, so they build together before they're tagged
+work:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    rm -f go.work go.work.sum
+    go work init
+    for dir in $(find . -name go.mod -exec dirname {} \; | sort); do
+        go work use "$dir"
+        path=$(awk '/^module /{print $2}' "$dir/go.mod")
+        for version in $(grep -ho "$path v[^ ]*" $(find . -name go.mod) | awk '{print $2}' | sort -u); do
+            go work edit -replace "$path@$version=$dir"
+        done
+    done
+
+# go mod tidy in every Go module; `just tidy check` verifies without writing. tidy ignores
+# go.work, so sibling modules are replaced by their local copies for the run and dropped after.
+tidy mode="fix":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    root=$PWD
+    for dir in $(find . -name go.mod -exec dirname {} \; | sort); do
+        (
+            cd "$dir"
+            replaced=()
+            trap 'for r in ${replaced[@]+"${replaced[@]}"}; do go mod edit -dropreplace "$r"; done' EXIT
+            for sibling in $(find "$root" -name go.mod -exec dirname {} \;); do
+                path=$(awk '/^module /{print $2}' "$sibling/go.mod")
+                for version in $(grep -o "$path v[^ ]*" go.mod | awk '{print $2}' | sort -u); do
+                    go mod edit -replace "$path@$version=$sibling"
+                    replaced+=("$path@$version")
+                done
+            done
+            go mod tidy {{ if mode == "check" { "-diff" } else { "" } }}
+        )
+    done
+
+# run tests in every Go module
+test: (_each "go test ./...")
+
+# gofumpt + goimports across every Go module (settings in .golangci.yaml); `just format check` verifies without writing
+format mode="fix": (_each ("golangci-lint fmt " + (if mode == "check" { "--diff " } else { "" }) + "./..."))
+
+# Go linters across every Go module; `just lint check` runs without fixing
+lint mode="fix": (_each ("golangci-lint run " + (if mode == "check" { "" } else { "--fix " }) + "./..."))

release-please-config.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "skip-changelog": true,
+  "bump-minor-pre-major": true,
+  "release-type": "go",
+  "tag-separator": "/",
+  "packages": {
+    "secret": {
+      "component": "secret"
+    }
+  }
+}