Add support for secrets

.buildkite/pipeline.yml

@@ -4,15 +4,15 @@ steps:
     command: .buildkite/steps/lint.sh
     plugins:
       - docker#v5.9.0:
-          image: "golangci/golangci-lint:v2.0-alpine"
+          image: "golangci/golangci-lint:v2.8-alpine"
 
   - name: ":go::test_tube: Test"
     key: test
     command: ".buildkite/steps/test.sh"
     artifact_paths: junit-*.xml
     plugins:
       - docker#v5.9.0:
-          image: "golang:1.24"
+          image: "golang:1.25"
           propagate-environment: true
       - artifacts#v1.9.0:
           upload: "cover.{html,out}"

buildkite.go

@@ -48,6 +48,7 @@ type Client struct {
 	Clusters                 *ClustersService
 	ClusterQueues            *ClusterQueuesService
 	ClusterTokens            *ClusterTokensService
+	ClusterSecrets           *ClusterSecretsService
 	FlakyTests               *FlakyTestsService
 	Jobs                     *JobsService
 	Organizations            *OrganizationsService
@@ -164,6 +165,7 @@ func (c *Client) populateDefaultServices() {
 	c.Clusters = &ClustersService{c}
 	c.ClusterQueues = &ClusterQueuesService{c}
 	c.ClusterTokens = &ClusterTokensService{c}
+	c.ClusterSecrets = &ClusterSecretsService{c}
 	c.FlakyTests = &FlakyTestsService{c}
 	c.Jobs = &JobsService{c}
 	c.Organizations = &OrganizationsService{c}

cluster_secrets.go

@@ -0,0 +1,139 @@
+package buildkite
+
+import (
+	"context"
+	"fmt"
+)
+
+// ClusterSecretsService handles communication with cluster secret related
+// methods of the Buildkite API.
+//
+// Buildkite API docs: https://buildkite.com/docs/apis/rest-api/clusters#cluster-secrets
+type ClusterSecretsService struct {
+	client *Client
+}
+
+type ClusterSecret struct {
+	ID           string         `json:"id,omitempty"`
+	GraphQLID    string         `json:"graphql_id,omitempty"`
+	Key          string         `json:"key,omitempty"`
+	Description  string         `json:"description,omitempty"`
+	Policy       string         `json:"policy,omitempty"`
+	URL          string         `json:"url,omitempty"`
+	ClusterURL   string         `json:"cluster_url,omitempty"`
+	CreatedAt    *Timestamp     `json:"created_at,omitempty"`
+	CreatedBy    ClusterCreator `json:"created_by"`
+	UpdatedAt    *Timestamp     `json:"updated_at,omitempty"`
+	UpdatedBy    ClusterCreator `json:"updated_by"`
+	LastReadAt   *Timestamp     `json:"last_read_at,omitempty"`
+	Organization string         `json:"organization,omitempty"`
+}
+
+type ClusterSecretCreate struct {
+	Key         string `json:"key"`
+	Value       string `json:"value,omitempty"`
+	Description string `json:"description,omitempty"`
+	Policy      string `json:"policy,omitempty"`
+}
+
+type ClusterSecretUpdate struct {
+	Description string `json:"description,omitempty"`
+	Policy      string `json:"policy,omitempty"`
+}
+
+type ClusterSecretValueUpdate struct {
+	Value string `json:"value"`
+}
+
+type ClusterSecretsListOptions struct {
+	ListOptions
+}
+
+func (css *ClusterSecretsService) List(ctx context.Context, org, clusterID string, opt *ClusterSecretsListOptions) ([]ClusterSecret, *Response, error) {
+	u := fmt.Sprintf("v2/organizations/%s/clusters/%s/secrets", org, clusterID)
+	u, err := addOptions(u, opt)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	req, err := css.client.NewRequest(ctx, "GET", u, nil)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	var secrets []ClusterSecret
+	resp, err := css.client.Do(req, &secrets)
+	if err != nil {
+		return nil, resp, err
+	}
+
+	return secrets, resp, err
+}
+
+func (css *ClusterSecretsService) Get(ctx context.Context, org, clusterID, secretID string) (ClusterSecret, *Response, error) {
+	u := fmt.Sprintf("v2/organizations/%s/clusters/%s/secrets/%s", org, clusterID, secretID)
+	req, err := css.client.NewRequest(ctx, "GET", u, nil)
+	if err != nil {
+		return ClusterSecret{}, nil, err
+	}
+
+	var secret ClusterSecret
+	resp, err := css.client.Do(req, &secret)
+	if err != nil {
+		return ClusterSecret{}, resp, err
+	}
+
+	return secret, resp, err
+}
+
+func (css *ClusterSecretsService) Create(ctx context.Context, org, clusterID string, input ClusterSecretCreate) (ClusterSecret, *Response, error) {
+	u := fmt.Sprintf("v2/organizations/%s/clusters/%s/secrets", org, clusterID)
+	req, err := css.client.NewRequest(ctx, "POST", u, input)
+	if err != nil {
+		return ClusterSecret{}, nil, err
+	}
+
+	var secret ClusterSecret
+	resp, err := css.client.Do(req, &secret)
+	if err != nil {
+		return ClusterSecret{}, resp, err
+	}
+
+	return secret, resp, err
+}
+
+func (css *ClusterSecretsService) Update(ctx context.Context, org, clusterID, secretID string, input ClusterSecretUpdate) (ClusterSecret, *Response, error) {
+	u := fmt.Sprintf("v2/organizations/%s/clusters/%s/secrets/%s", org, clusterID, secretID)
+	req, err := css.client.NewRequest(ctx, "PUT", u, input)
+	if err != nil {
+		return ClusterSecret{}, nil, err
+	}
+
+	var secret ClusterSecret
+	resp, err := css.client.Do(req, &secret)
+	if err != nil {
+		return ClusterSecret{}, resp, err
+	}
+
+	return secret, resp, err
+}
+
+func (css *ClusterSecretsService) UpdateValue(ctx context.Context, org, clusterID, secretID string, input ClusterSecretValueUpdate) (*Response, error) {
+	u := fmt.Sprintf("v2/organizations/%s/clusters/%s/secrets/%s/value", org, clusterID, secretID)
+	req, err := css.client.NewRequest(ctx, "PUT", u, input)
+	if err != nil {
+		return nil, err
+	}
+
+	return css.client.Do(req, nil)
+}
+
+func (css *ClusterSecretsService) Delete(ctx context.Context, org, clusterID, secretID string) (*Response, error) {
+	u := fmt.Sprintf("v2/organizations/%s/clusters/%s/secrets/%s", org, clusterID, secretID)
+	req, err := css.client.NewRequest(ctx, "DELETE", u, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return css.client.Do(req, nil)
+}