Review: module issue's pre-check factored and tested; a pair delivery for a requirement the module keeps no secret for is refused; builder issue's usage says the module comes first

2026-09-21 23:58:36 +02:00
parent 66332705cd
commit 0d1f2a4152
5 changed files with 61 additions and 10 deletions
@@ -159,6 +159,9 @@ func (i *Inventory) AcceptSecretForPair(ctx context.Context, name, consumer, con
 			return fmt.Errorf("%s does not keep %q for %q; it keeps: %s",
 				consumerModule, local, name, orNone(sortedNames(locals)))
 		}
+	} else if m.Secrets[name] == "" {
+		return fmt.Errorf("%s requires %q but keeps no secret for it, so a delivered value would sit unread; "+
+			"it keeps secrets for: %s", consumerModule, name, orNone(sortedNames(m.Secrets)))
 	} else if local != "" {
 		return fmt.Errorf("%s keeps one secret for %q, not several; drop --local", consumerModule, name)
 	}