Add revision field to secretspec.toml format

domenkozar · claude · domenkozar · commit fc9c835f36fa · 2025-07-07T15:43:38.000-05:00
This change introduces a revision field to track the specification version, ensuring forward compatibility as the format evolves. All secretspec.toml files now require revision = "1.0" in the [project] section. - Add revision field to ProjectInfo struct with default value "1.0" - Add validation to ensure only revision "1.0" is accepted - Update all test fixtures and examples to include revision = "1.0" - Update README.md documentation to show revision in examples - Ensure secretspec init command generates files with revision field 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
diff --git a/README.md b/README.md
@@ -78,6 +78,7 @@ Each project has a `secretspec.toml` file that declares the required secrets:
 ```toml
 [project]
 name = "my-app"  # Inferred from current directory name when using `secretspec init`
+revision = "1.0"
 
 [secrets.DATABASE_URL]
 description = "PostgreSQL connection string"
diff --git a/examples/codegen_example/secretspec.toml b/examples/codegen_example/secretspec.toml
@@ -1,5 +1,6 @@
 [project]
 name = "example-app"
+revision = "1.0"
 
 [secrets.DATABASE_URL]
 description = "PostgreSQL connection string"
diff --git a/secretspec-derive/src/lib.rs b/secretspec-derive/src/lib.rs
@@ -315,7 +315,7 @@ pub fn define_secrets(input: TokenStream) -> TokenStream {
             }
 
             /// Load with specific provider and profile, returns profile-specific types
-            pub fn load_profile(provider: Provider, profile: Profile) -> Result<SecretSpecProfile, secretspec::SecretSpecError> {
+            pub fn load_with_profile(provider: Provider, profile: Profile) -> Result<SecretSpecProfile, secretspec::SecretSpecError> {
                 let spec = secretspec::SecretSpec::load()?;
                 let provider_str = match provider {
                     Provider::Keyring => "keyring",
diff --git a/secretspec-derive/src/tests.rs b/secretspec-derive/src/tests.rs
@@ -28,6 +28,7 @@ mod tests {
         let config: ProjectConfig = toml::from_str(&format!(
             r#"[project]
 name = "test"
+revision = "1.0"
 {}"#,
             toml_str
         ))
@@ -61,6 +62,7 @@ name = "test"
         let config: ProjectConfig = toml::from_str(&format!(
             r#"[project]
 name = "test"
+revision = "1.0"
 {}"#,
             toml_str
         ))
@@ -94,6 +96,7 @@ name = "test"
         let config: ProjectConfig = toml::from_str(&format!(
             r#"[project]
 name = "test"
+revision = "1.0"
 {}"#,
             toml_str
         ))
@@ -139,6 +142,7 @@ name = "test"
         let config: ProjectConfig = toml::from_str(&format!(
             r#"[project]
 name = "test"
+revision = "1.0"
 {}"#,
             toml_str
         ))
@@ -174,6 +178,7 @@ name = "test"
         let config: ProjectConfig = toml::from_str(&format!(
             r#"[project]
 name = "test"
+revision = "1.0"
 {}"#,
             toml_str
         ))
diff --git a/secretspec-derive/tests/fixtures/basic.toml b/secretspec-derive/tests/fixtures/basic.toml
@@ -1,5 +1,6 @@
 [project]
 name = "test-project"
+revision = "1.0"
 
 [secrets.API_KEY]
 description = "API key for external service"
diff --git a/secretspec-derive/tests/fixtures/complex.toml b/secretspec-derive/tests/fixtures/complex.toml
@@ -1,5 +1,6 @@
 [project]
 name = "complex-project"
+revision = "1.0"
 
 # Always required, no default
 [secrets.ALWAYS_REQUIRED]
diff --git a/secretspec-derive/tests/fixtures/empty.toml b/secretspec-derive/tests/fixtures/empty.toml
@@ -1,5 +1,6 @@
 [project]
 name = "empty-project"
+revision = "1.0"
 
 [secrets]
 # No secrets defined
diff --git a/secretspec-derive/tests/fixtures/profiles.toml b/secretspec-derive/tests/fixtures/profiles.toml
@@ -1,5 +1,6 @@
 [project]
 name = "profile-test"
+revision = "1.0"
 
 [secrets.API_KEY]
 description = "API key"
diff --git a/secretspec-derive/tests/snapshot_tests.rs b/secretspec-derive/tests/snapshot_tests.rs
@@ -32,6 +32,7 @@ fn test_basic_generation_snapshot() {
     let toml_content = r#"
 [project]
 name = "test"
+revision = "1.0"
 
 [secrets.API_KEY]
 required = true
@@ -49,6 +50,7 @@ fn test_profile_generation_snapshot() {
     let toml_content = r#"
 [project]
 name = "test"
+revision = "1.0"
 
 [secrets.API_KEY]
 required = true
diff --git a/secretspec-derive/tests/ui/valid_generation_embedded.toml b/secretspec-derive/tests/ui/valid_generation_embedded.toml
@@ -1,5 +1,6 @@
 [project]
 name = "test-project"
+revision = "1.0"
 
 [secrets.API_KEY]
 description = "API key for external service"
diff --git a/secretspec-types/src/lib.rs b/secretspec-types/src/lib.rs
@@ -10,6 +10,12 @@ pub struct ProjectConfig {
 #[derive(Debug, Serialize, Deserialize)]
 pub struct ProjectInfo {
     pub name: String,
+    #[serde(default = "default_revision")]
+    pub revision: String,
+}
+
+fn default_revision() -> String {
+    "1.0".to_string()
 }
 
 #[derive(Debug, Serialize, Deserialize)]
diff --git a/secretspec.toml b/secretspec.toml
@@ -1,5 +1,6 @@
 [project]
 name = "secretspec"
+revision = "1.0"
 
 [secrets]
 
diff --git a/src/lib.rs b/src/lib.rs
@@ -23,6 +23,10 @@ pub enum SecretSpecError {
     Io(#[from] std::io::Error),
     #[error("TOML parsing error: {0}")]
     Toml(#[from] toml::de::Error),
+    #[error(
+        "Unsupported secretspec revision '{0}'. This version of secretspec only supports revision '1.0'"
+    )]
+    UnsupportedRevision(String),
     #[error("TOML serialization error: {0}")]
     TomlSer(#[from] toml::ser::Error),
     #[error("Keyring error: {0}")]
@@ -92,6 +96,7 @@ pub fn project_config_from_path(from: &Path) -> Result<ProjectConfig> {
                 .unwrap_or_default()
                 .to_string_lossy()
                 .to_string(),
+            revision: "1.0".to_string(),
         },
         secrets,
     })
@@ -531,11 +536,20 @@ fn get_config_path() -> Result<PathBuf> {
 
 pub fn parse_spec(path: &Path) -> Result<ProjectConfig> {
     let content = fs::read_to_string(path).map_err(|_| SecretSpecError::NoManifest)?;
-    Ok(toml::from_str(&content)?)
+    parse_spec_from_str(&content)
 }
 
 pub fn parse_spec_from_str(content: &str) -> Result<ProjectConfig> {
-    Ok(toml::from_str(content)?)
+    let config: ProjectConfig = toml::from_str(content)?;
+
+    // Validate revision
+    if config.project.revision != "1.0" {
+        return Err(SecretSpecError::UnsupportedRevision(
+            config.project.revision,
+        ));
+    }
+
+    Ok(config)
 }
 
 fn load_project_config() -> Result<ProjectConfig> {
@@ -560,6 +574,7 @@ mod tests {
         let project_config = ProjectConfig {
             project: ProjectInfo {
                 name: "test_project".to_string(),
+                revision: "1.0".to_string(),
             },
             secrets: {
                 let mut secrets = HashMap::new();
@@ -618,6 +633,7 @@ mod tests {
         let project_config = ProjectConfig {
             project: ProjectInfo {
                 name: "test_project".to_string(),
+                revision: "1.0".to_string(),
             },
             secrets: {
                 let mut secrets = HashMap::new();
@@ -663,6 +679,7 @@ mod tests {
         let project_config = ProjectConfig {
             project: ProjectInfo {
                 name: "test_project".to_string(),
+                revision: "1.0".to_string(),
             },
             secrets: {
                 let mut secrets = HashMap::new();

Original file line number	Diff line number	Diff line change
`@@ -315,7 +315,7 @@ pub fn define_secrets(input: TokenStream) -> TokenStream {`
`315`	`315`	`}`
`316`	`316`
`317`	`317`	`/// Load with specific provider and profile, returns profile-specific types`
`318`		`- pub fn load_profile(provider: Provider, profile: Profile) -> Result<SecretSpecProfile, secretspec::SecretSpecError> {`
	`318`	`+ pub fn load_with_profile(provider: Provider, profile: Profile) -> Result<SecretSpecProfile, secretspec::SecretSpecError> {`
`319`	`319`	`let spec = secretspec::SecretSpec::load()?;`
`320`	`320`	`let provider_str = match provider {`
`321`	`321`	`Provider::Keyring => "keyring",`