Support environment variables in gcp_credentials: workload_identity_provider: etc

[anarazel]

Hi,

right now it is not supported to configure gcp_credentials etc via environment variables. It'd be useful to support doing so, to allow different forks of a repository to use different workload identity providers.

I searched through the cirrus_cli code, without finding relevant references to gcp_credentials/workload_identity_provider/.. - presumably that is the problem?

Regards,

Andres

[fkorotkov]

For reference, here is where the credentials are getting parsed

cirrus-cli/pkg/parser/instance/proto.go

Lines 169 to 181 in 0ad7d8e

	if strings.HasSuffix(fieldName, "credentials") || strings.HasSuffix(fieldName, "config") {
	parseCallback := func(node *node.Node) error {
	value, err := node.GetCredentials(mergedEnv)
	if err != nil {
	return err
	}
	instance.proto.Set(field, protoreflect.ValueOfString(value))
	return nil
	}
	// some trickery to be able to specify top level credentials for instances
	instance.CollectibleField(fieldName, schema.String(fieldDescription), parseCallback)
	} else {

[anarazel]

For reference, here is where the credentials are getting parsed

Hm - if I understand correctly, env vars get expanded, but just at the top-level (e.g. gcp_credentials: $VAR), not when the variables are further down (as in the gcp_credentials: workload_identity_provider: $VAR case):

cirrus-cli/pkg/parser/node/accessor.go

Lines 47 to 51 in 945fd44

	func (node *Node) GetCredentials(env map[string]string) (string, error) {
	switch node.Value.(type) {
	case *ScalarValue:
	return node.GetExpandedStringValue(env)
	case *MapValue:

Looks like GetMapOrListOfMapsWithExpansion might do the trick?