Add support for Infisical #857

v0ctor · 2025-10-17T14:11:42Z

This PR adds support for Infisical, either the SaaS or a self-deployment.

By using the official SDK, the same environment variables also work for the official Ansible integration, which makes it very convenient for those who use both tools together for IaC.

yxxhero · 2025-10-18T00:21:34Z

@v0ctor DCO issue.

yxxhero · 2025-10-18T00:22:18Z

pkg/providers/infisical/infisical.go

+	if err != nil {
+		return err
+	}
+
+	return nil


Fixed! Thanks.

Copilot

Pull Request Overview

This PR adds support for Infisical, a secrets management platform, as a new provider in vals. The integration uses the official Infisical Go SDK and supports multiple authentication methods (Universal Auth, Kubernetes, AWS IAM, Azure, GCP IAM, and GCP ID Token), making it compatible with the official Ansible integration for users who use both tools.

Key changes:

Adds a new infisical provider with support for retrieving secrets via the Infisical Go SDK
Integrates the provider into the vals runtime, string provider, and string map provider systems
Adds comprehensive documentation for authentication methods and usage examples

Reviewed Changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
vals.go	Registers the Infisical provider in the main runtime
pkg/stringprovider/stringprovider.go	Adds Infisical to the string provider factory
pkg/stringmapprovider/stringmapprovider.go	Adds Infisical to the string map provider factory
pkg/providers/infisical/infisical.go	Implements the complete Infisical provider with authentication and secret retrieval
go.mod	Adds the Infisical Go SDK dependency (v0.5.100) and related transitive dependencies
README.md	Documents the Infisical provider with environment variables, parameters, examples, and authentication methods

Copilot · 2025-10-18T00:23:42Z

pkg/providers/infisical/infisical.go

+	path := cfg.String("path")
+
+	if path != "" {
+		p.path = "/" + path
+	}


The path handling adds a leading slash unconditionally, which could result in double slashes if the user already provides a path with a leading slash (e.g., '/prometheus' becomes '//prometheus'). Consider trimming leading slashes from the input before adding one: p.path = '/' + strings.TrimPrefix(path, '/') or only add the slash if it's missing.

Legit. Fixed.

Copilot · 2025-10-18T00:23:42Z

pkg/providers/infisical/infisical.go

+	p.version, _ = strconv.Atoi(
+		cfg.String("version"),
+	)


Silent failure when parsing the version could mask configuration errors. If an invalid version string is provided, it silently defaults to 0 without informing the user. Consider logging a warning when the version fails to parse, or return an error from the New function if version parsing is critical.

Suggested change

p.version, _ = strconv.Atoi(

cfg.String("version"),

)

versionStr := cfg.String("version")

versionInt, err := strconv.Atoi(versionStr)

if versionStr != "" && err != nil {

l.Warnf("Invalid version string '%s', defaulting to 0: %v", versionStr, err)

p.version = 0

} else {

p.version = versionInt

}

Legit. Fixed.

Copilot · 2025-10-18T00:23:42Z

README.md

+
+Examples:
+
+- `ref+infisical://WEBHOOK_URL?project=infrastructure-hue8&path=prometheus&environment=prod`: gets the secret at "infrastructure" (project slug) -> "prometheus" (folder) -> "WEBHOOK_URL" (secret) -> "prod" (environment).


The example description states the project slug is 'infrastructure' but the URL parameter shows 'infrastructure-hue8'. This inconsistency could confuse users. Either update the parameter to match the description or update the description to accurately reflect the parameter value.

Suggested change

- `ref+infisical://WEBHOOK_URL?project=infrastructure-hue8&path=prometheus&environment=prod`: gets the secret at "infrastructure" (project slug) -> "prometheus" (folder) -> "WEBHOOK_URL" (secret) -> "prod" (environment).

- `ref+infisical://WEBHOOK_URL?project=infrastructure-hue8&path=prometheus&environment=prod`: gets the secret at "infrastructure-hue8" (project slug) -> "prometheus" (folder) -> "WEBHOOK_URL" (secret) -> "prod" (environment).

Legit. Fixed.

Copilot · 2025-10-18T00:23:42Z

README.md

+
+Depending on which one is chosen with the `INFISICAL_AUTH_METHOD` environment variable, the following environment variables must also be provided.
+
+- **Universal**:`UNIVERSAL_AUTH`


Missing space after the colon. Should be 'Universal: UNIVERSAL_AUTH' for consistency with the other authentication method entries.

Suggested change

- **Universal**:`UNIVERSAL_AUTH`

- **Universal**: `UNIVERSAL_AUTH`

Legit. Fixed.

Signed-off-by: Víctor Díaz Marco <[email protected]>

v0ctor · 2025-10-20T09:30:27Z

All issues fixed!

v0ctor requested review from itscaro, mumoshu, xiaomudk and yxxhero as code owners October 17, 2025 14:11

yxxhero reviewed Oct 18, 2025

View reviewed changes

yxxhero requested a review from Copilot October 18, 2025 00:22

Copilot AI reviewed Oct 18, 2025

View reviewed changes

v0ctor force-pushed the feature/infisical branch 2 times, most recently from db9d47c to bd89494 Compare October 20, 2025 09:25

v0ctor added 5 commits October 20, 2025 11:29

Add support for Infisical.

a197946

Signed-off-by: Víctor Díaz Marco <[email protected]>

Remove redundant check.

79de654

Signed-off-by: Víctor Díaz Marco <[email protected]>

Improve path handling.

2d590ea

Signed-off-by: Víctor Díaz Marco <[email protected]>

Handle version parsing errors.

128ab63

Signed-off-by: Víctor Díaz Marco <[email protected]>

Fix readme errors.

6b9b459

Signed-off-by: Víctor Díaz Marco <[email protected]>

v0ctor force-pushed the feature/infisical branch from bd89494 to 6b9b459 Compare October 20, 2025 09:29

yxxhero approved these changes Oct 20, 2025

View reviewed changes

yxxhero merged commit cdb948d into helmfile:main Oct 20, 2025
5 checks passed

BrewTestBot mentioned this pull request Nov 19, 2025

vals 0.42.5 Homebrew/homebrew-core#255028

Merged

-	p.version, _ = strconv.Atoi(
-		cfg.String("version"),
-	)
+	versionStr := cfg.String("version")
+	versionInt, err := strconv.Atoi(versionStr)
+	if versionStr != "" && err != nil {
+		l.Warnf("Invalid version string '%s', defaulting to 0: %v", versionStr, err)
+		p.version = 0
+	} else {
+		p.version = versionInt
+	}


		Examples:

		- `ref+infisical://WEBHOOK_URL?project=infrastructure-hue8&path=prometheus&environment=prod`: gets the secret at "infrastructure" (project slug) -> "prometheus" (folder) -> "WEBHOOK_URL" (secret) -> "prod" (environment).


		Depending on which one is chosen with the `INFISICAL_AUTH_METHOD` environment variable, the following environment variables must also be provided.

		- Universal:`UNIVERSAL_AUTH`

	- Universal:`UNIVERSAL_AUTH`
	- Universal: `UNIVERSAL_AUTH`

Add support for Infisical #857

Add support for Infisical #857

Uh oh!

Conversation

v0ctor commented Oct 17, 2025

Uh oh!

yxxhero commented Oct 18, 2025

Uh oh!

yxxhero Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

v0ctor Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

v0ctor Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

v0ctor Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

v0ctor Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

v0ctor Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

v0ctor commented Oct 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants