Skip to content

extdeps gcp.SecretManager: wire types carry GCP's real JSON keys (native broker class D) #13147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gunbai-bot merged 1 commit into from
Oct 3, 2026
Merged

extdeps gcp.SecretManager: wire types carry GCP's real JSON keys (native broker class D) #13147

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 17 additions & 9 deletions dag/extdeps/cloud/gcp/secret_manager.dag
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ type GcpSecret {
project: String
replication: SmReplication
labels: Map<String, String>?
create_time: String
create_time: String from "createTime"
etag: String
}

Expand All @@ -61,9 +61,9 @@ type SmVersionState = SmEnabled | SmDisabled | SmDestroyed
type GcpSecretVersion {
name: SmResolvedVersionIdentity
state: SmVersionState
create_time: String
create_time: String from "createTime"
etag: String?
destroy_time: String?
destroy_time: String? from "destroyTime"
}

// Pagination is part of this response's MEANING, not a transport detail to
Expand All @@ -74,12 +74,20 @@ type GcpSecretVersion {
// representable upstream of any policy that would otherwise silently narrow.
type ListSecretVersionsResponse {
versions: List<GcpSecretVersion>
next_page_token: String?
total_size: Int?
next_page_token: String? from "nextPageToken"
total_size: Int? from "totalSize"
}

// The access response is the version's resource name beside its payload, and the payload's data is
// base64 TEXT on the JSON wire (projects.secrets.versions.access, AccessSecretVersionResponse /
// SecretPayload, Secret Manager v1). Decoding it to octets is the decode outcome below, not serde's.
type SecretPayload {
data: Bytes
data: String
}

type AccessSecretVersionResponse {
name: SmResolvedVersionIdentity
payload: SecretPayload
}

type SmRotationSchedule {
Expand Down Expand Up @@ -480,7 +488,7 @@ service gcp.SecretManager {
readonly
transport rest { method: GET, path: "/v1/projects/\{project_id\}/secrets/\{secret\}/versions/\{version\}:access" }
response {
200 => SecretPayload
200 => AccessSecretVersionResponse
401 => GcpErrorShape
403 => GcpErrorShape
404 => GcpErrorShape
Expand Down Expand Up @@ -539,7 +547,7 @@ service gcp.SecretManager {
}
output {
versions: List<GcpSecretVersion>
next_page_token: String from "nextPageToken"
next_page_token: String? from "nextPageToken"
outcome: RestOutcome
}
readonly
Expand Down Expand Up @@ -642,7 +650,7 @@ service gcp.SecretManager {
operation DestroyVersion {
requires Network
input { access_token: Secret, version_name: SmResolvedVersionIdentity, etag: String = "" }
output { name: SmResolvedVersionIdentity, state: SmVersionState, destroy_time: String from "destroyTime" }
output { name: SmResolvedVersionIdentity, state: SmVersionState, destroy_time: String? from "destroyTime" }

transport rest {
method: POST,
Expand Down