Fix secretspec-derive tests compilation and execution

- Fix macro to access validation_result.secrets field instead of calling get() directly on ValidationResult
- Add missing [secrets] section to empty.toml fixture
- Update integration tests to expect correct types (fields with defaults are Option<String>)
- Add required description fields to unit test TOML configurations
- Update UI test stderr expectations for trybuild

The secretspec-derive tests now compile and run successfully as part of cargo test --workspace.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: domenkozar

secretspec-derive/src/lib.rs

@@ -306,7 +306,8 @@ pub fn define_secrets(input: TokenStream) -> TokenStream {
                     Provider::Env => "env",
                 };
 
-                let secrets = spec.validate(Some(provider_str.to_string()), None)?;
+                let validation_result = spec.validate(Some(provider_str.to_string()), None)?;
+                let secrets = validation_result.secrets;
 
                 Ok(Self {
                     #(#load_assignments,)*
@@ -325,10 +326,11 @@ pub fn define_secrets(input: TokenStream) -> TokenStream {
                     #(#profile_to_str,)*
                 };
 
-                let secrets = spec.validate(
+                let validation_result = spec.validate(
                     Some(provider_str.to_string()),
                     Some(profile_str.to_string())
                 )?;
+                let secrets = validation_result.secrets;
 
                 match profile {
                     #(#load_profile_arms,)*

secretspec-derive/src/tests.rs

@@ -17,9 +17,11 @@ mod tests {
     fn test_parse_basic_config() {
         let toml_str = r#"
             [secrets.API_KEY]
+            description = "API key"
             required = true
             
             [secrets.DATABASE_URL]
+            description = "Database URL"
             required = false
             default = "postgres://localhost"
         "#;
@@ -46,6 +48,7 @@ name = "test"
     fn test_parse_profile_overrides() {
         let toml_str = r#"
             [secrets.API_KEY]
+            description = "API key"
             required = true
             
             [secrets.API_KEY.development]
@@ -82,6 +85,7 @@ name = "test"
         // Test that a field that's optional in any profile becomes Option<String>
         let toml_str = r#"
             [secrets.SOMETIMES_REQUIRED]
+            description = "Sometimes required secret"
             required = true
             
             [secrets.SOMETIMES_REQUIRED.development]
@@ -123,6 +127,7 @@ name = "test"
     fn test_always_required_field() {
         let toml_str = r#"
             [secrets.ALWAYS_REQUIRED]
+            description = "Always required secret"
             required = true
             
             [secrets.ALWAYS_REQUIRED.development]
@@ -162,6 +167,7 @@ name = "test"
     fn test_default_makes_optional() {
         let toml_str = r#"
             [secrets.HAS_DEFAULT]
+            description = "Secret with default"
             required = true
             default = "some-default"
         "#;

secretspec-derive/tests/fixtures/empty.toml

@@ -1,4 +1,5 @@
 [project]
 name = "empty-project"
 
+[secrets]
 # No secrets defined

secretspec-derive/tests/integration_test.rs

@@ -42,7 +42,7 @@ mod profile_generation {
                     redis_url,
                 } => {
                     let _: Option<String> = api_key; // Optional in dev
-                    let _: String = database_url; // Required but has default
+                    let _: Option<String> = database_url; // Required but has default
                     let _: Option<String> = redis_url; // Optional
                 }
                 _ => panic!("Expected Development variant"),
@@ -70,7 +70,7 @@ mod profile_generation {
         // Verify the union struct has Option for fields that are optional in any profile
         fn _test_field_types(s: SecretSpec) {
             let _: Option<String> = s.api_key; // Optional in development
-            let _: String = s.database_url; // Always required (has default in dev)
+            let _: Option<String> = s.database_url; // Has default in dev, so optional in union type
             let _: Option<String> = s.redis_url; // Optional by default
         }
     }

secretspec-derive/tests/ui/file_not_found.stderr

@@ -2,4 +2,6 @@ error: Failed to read this/file/does/not/exist.toml: No such file or directory (
  --> tests/ui/file_not_found.rs:4:1
   |
 4 | define_secrets!("this/file/does/not/exist.toml");
-  | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  |
+  = note: this error originates in the macro `define_secrets` (in Nightly builds, run with -Z macro-backtrace for more info)

secretspec-derive/tests/ui/invalid_toml.rs

@@ -1,6 +1,6 @@
 use secretspec_derive::define_secrets;
 
 // This should fail because the TOML is invalid
-define_secrets!("tests/fixtures/invalid_toml.txt");
+define_secrets!("secretspec-derive/tests/fixtures/invalid_toml.txt");
 
 fn main() {}

secretspec-derive/tests/ui/valid_generation.rs

@@ -1,13 +1,15 @@
 use secretspec_derive::define_secrets;
-use secretspec::codegen::Provider;
 
 // This should compile successfully
-define_secrets!("tests/fixtures/basic.toml");
+define_secrets!("secretspec-derive/tests/fixtures/basic.toml");
 
 fn main() {
     // Verify the generated types exist
     let _ = std::mem::size_of::<SecretSpec>();
 
+    // Verify the Provider enum was generated
+    let _ = Provider::Keyring;
+    
     // Verify the load method exists
     fn test_load() -> Result<SecretSpec, secretspec::SecretSpecError> {
         SecretSpec::load(Provider::Keyring)