Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the development and testing workflow for AWS integrations by transitioning all related tests to use LocalStack. This change allows developers to run AWS-dependent tests locally and in CI without requiring actual AWS credentials, leading to faster feedback cycles and reduced operational costs. The introduction of an optional endpoint field across AWS providers also offers greater flexibility for custom or mock AWS environments.

Highlights

• AWS Provider Configuration: Added an optional endpoint field to the AWS KMS, Secrets Manager, and Parameter Store providers, allowing custom endpoint configurations (e.g., for LocalStack).
• AWS Test Refactoring: Converted all AWS integration tests (aws_kms.bats, aws_secrets_manager.bats, aws_parameter_store.bats) to utilize LocalStack for mock AWS services, eliminating the dependency on real AWS credentials.
• CI/CD Enhancements: Expanded the LocalStack services configured in CI from sts,iam to sts,iam,kms,secretsmanager,ssm to support the new testing approach.
• Test Setup Automation: Implemented automated setup for KMS keys, test secrets, and dummy AWS credentials within the CI environment to facilitate LocalStack-based testing.
• Test Optimization: Removed the @expensive tag from Secrets Manager tests, as they no longer incur real AWS costs or significant delays due to the LocalStack integration.

Greptile Summary

This PR delivers two related improvements: it fixes a silent-plaintext security regression in fnox set (encryption failures are now hard errors across all encryption providers), and it migrates all AWS integration tests to LocalStack, adding an optional endpoint field to the aws-kms, aws-sm, and aws-ps providers to support custom endpoint URLs.

Key changes:

• src/commands/set.rs: Encryption provider errors now propagate immediately via await? instead of warning and silently storing plaintext — the correct security behavior. Affected tests (test/local_config.bats, test/profile_config.bats) were correctly updated to use the plain provider type to avoid triggering encryption where not needed.
• src/providers/aws_kms.rs, aws_ps.rs, aws_sm.rs: Each provider gains an optional endpoint field; when set, the AWS SDK client is built via Builder::from(&config).endpoint_url(...), the idiomatic SDK v2 pattern. Provider TOML files and JSON schema updated consistently.
• test/aws_kms.bats, test/aws_secrets_manager.bats, test/aws_parameter_store.bats: Migrated from real-AWS credentials to LocalStack. Real-AWS credential checks replaced with LOCALSTACK_ENDPOINT guards and health-check retry loops; all aws CLI invocations receive --endpoint-url "$LOCALSTACK_ENDPOINT". The test for wrong-key encryption correctly asserts failure and verifies error output contains the provider name.
• .github/workflows/ci.yml: LocalStack services expanded from sts,iam to sts,iam,kms,secretsmanager,ssm. KMS key/alias and Secrets Manager secret are pre-created after health check, and LOCALSTACK_ENDPOINT is persisted to $GITHUB_ENV for the test step.
• The # bats file_tags=expensive tag was removed from aws_secrets_manager.bats, allowing tests to run on release-plz PRs where they were previously skipped (reflecting the shift to cheaper LocalStack-based tests instead of real AWS).

All changes are focused and correct. The production code changes are minimal and well-scoped; the endpoint plumbing is symmetric across all three AWS providers. Test migration is thorough and consistent.

Confidence Score: 5/5

• All changes are focused, correct, and well-tested. The production security fix (hard fail on encryption errors) is the intended behaviour and properly scoped. AWS test migration to LocalStack is thorough and consistent across all three providers.
• Confidence 5/5 — The PR accomplishes exactly what it sets out to do with minimal, correct code changes. The security fix (encryption hard-fail) is explicitly described in the PR and is the right behaviour. The endpoint plumbing is idiomatic and symmetric across all AWS providers. Test migration is comprehensive and includes proper health checks, guard clauses, and assertions. No logic bugs or inconsistencies detected.
• No files require special attention. All changes are correct and well-integrated.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["fnox set KEY value --provider P"] --> B{"provider is<br/>encryption type?"}
    B -- No --> C{"provider is<br/>remote storage?"}
    C -- No --> D["Store plaintext in fnox.toml"]
    C -- Yes --> E["provider.put_secret(key, value)"]
    E -- error --> F["Propagate error ❌"]
    E -- ok --> G["Store remote key ref in fnox.toml"]
    B -- Yes --> H{"dry-run?"}
    H -- Yes --> I["Store '<encrypted>' placeholder"]
    H -- No --> J["provider.encrypt(value)"]
    J -- error --> K["Hard fail — propagate error ❌<br/>(previously: warn + store plaintext)"]
    J -- ok --> L["Store base64 ciphertext in fnox.toml"]

    subgraph AWS Providers
        M["AwsKmsProvider<br/>(encrypt)"] --> N{"endpoint set?"}
        N -- Yes --> O["Build client with endpoint_url<br/>e.g. http://localhost:4566"]
        N -- No --> P["Build client with default AWS endpoint"]
    end

    J --> M

_{Last reviewed commit: 1c4aeae}

bugbot run