feat: secret patterns for all of a repo's config files, with per-type overrides (#82)

Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>

internal/config/config.go

@@ -154,8 +154,10 @@ type Repos struct {
 	// a repo's .sops.yaml creation_rules say where to look.
 	Include []string `yaml:"include"`
 	Exclude []string `yaml:"exclude"`
-	// Spring says which keys of Spring Boot config files are secrets.
-	Spring repo.SpringPatterns `yaml:"spring"`
+	// SecretPatterns say which keys of config files are secrets; Spring
+	// overrides them for Spring Boot's, list by list.
+	SecretPatterns repo.SecretPatterns `yaml:"secretPatterns"`
+	Spring         repo.FileType       `yaml:"spring"`
 }
 
 type Azure struct {
@@ -295,8 +297,9 @@ func (c Config) validate(path string) error {
 			return fmt.Errorf("%s: %s: %s is negative", path, name, d)
 		}
 	}
-	if err := c.Providers.Repos.Spring.Check(); err != nil {
-		return fmt.Errorf("%s: providers.repos.%w", path, err)
+	if err := errors.Join(c.Providers.Repos.SecretPatterns.Check("providers.repos.secretPatterns"),
+		c.Providers.Repos.Spring.SecretPatterns.Check("providers.repos.spring.secretPatterns")); err != nil {
+		return fmt.Errorf("%s: %w", path, err)
 	}
 	for i, v := range c.Providers.Azure.Vaults {
 		if !strings.HasPrefix(v, "https://") {

internal/config/config_test.go

@@ -84,7 +84,8 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"workspace":  "sharing:\n  key: \"{{secrets/team/env-share}}\"\n",
 		"short keys": "sharing:\n  keyRules:\n    minLength: 8\n",
 		"classes":    "sharing:\n  keyRules:\n    minClasses: 5\n",
-		"regexp":     "providers:\n  repos:\n    spring:\n      keys: [\"(pass\"]\n",
+		"regexp":     "providers:\n  repos:\n    secretPatterns:\n      keys: [\"(pass\"]\n",
+		"spring re":  "providers:\n  repos:\n    spring:\n      secretPatterns:\n        values: [\"(\"]\n",
 	} {
 		if _, err := LoadAll([]string{write(t, content)}); err == nil {
 			t.Errorf("%s: no error", name)