Revert "fix: less strict unmarshalling for secret var (#4723)"

[BearTS]

Summary

Briefly explain the purpose of this PR and the problem it solves.

Changes

• What was changed and why
• Any notable design decisions or trade-offs

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Describe the steps to validate this change. Include commands and expected outcomes.

# Core/Transports
go version
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

If adding new configs or environment variables, document them here.

Screenshots/Recordings

If UI changes, add before/after screenshots or short clips.

Breaking changes

• Yes
• No

If yes, describe impact and migration instructions.

Related issues

Link related issues and discussions. Example: Closes #123

Security considerations

Note any security implications (auth, secrets, PII, sandboxing, etc.).

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[BearTS]

• fix: parse SecretVar JSON with ref/env_var fields even when value is absent #5146
• Revert "fix: less strict unmarshalling for secret var (#4723)" #5145 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 35 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: de7eec7b-d9a7-43dc-875b-adf903d68154

📥 Commits

Reviewing files that changed from the base of the PR and between 344d2ea and 6e3100b.

📒 Files selected for processing (2)

• core/schemas/secretvar.go
• core/schemas/secretvar_test.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch revert-recent-secret-var-fix

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 4/5

SecretVar parsing needs a fix before merging.

• Value-less SecretVar objects can bypass the env/vault compatibility decoder.
• The affected path stores those objects as plaintext instead of resolving the secret reference.
• The removed tests covered the env-var form of this regression.

core/schemas/secretvar.go

Security Review

Secret reference handling can regress for value-less SecretVar objects. Those inputs can now be treated as plaintext instead of resolving env or vault secrets.

Important Files Changed

Filename	Overview
core/schemas/secretvar.go	Restores strict value-field gating before SecretVar object parsing, which can bypass existing env/vault compatibility branches.
core/schemas/secretvar_test.go	Removes coverage for value-less env_var and from_env SecretVar objects.

_{Reviews (1): Last reviewed commit: "Revert "fix: less strict unmarshalling f..." | Re-trigger Greptile}

[Pratham-Mishra04]

Merge activity

• Jul 13, 11:24 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 13, 11:25 AM UTC: @Pratham-Mishra04 merged this pull request with Graphite.