feat: add AWS Secrets Manager provider

[yohamta0]

Summary

• add the aws-secrets-manager DAG secret provider using the AWS SDK default credential chain
• support secret names and ARNs, region overrides, version IDs and stages, binary values, and optional JSON field extraction
• add global secrets.aws.region configuration, DAGU_SECRETS_AWS_REGION, schema coverage, and tests

Testing

• make fmt
• go test ./internal/cmn/secrets ./internal/cmn/config ./internal/cmn/schema -count=1

Part of #798

---

Summary by cubic

Adds an AWS Secrets Manager secret provider for DAG secrets using AWS SDK default credentials. Adds a global default region, strict ARN/region validation, and a non-blocking per‑region client cache.

• New Features

  • New secret provider aws-secrets-manager.
  • Accepts secret names or ARNs; supports version_id and version_stage.
  • Region from per-ref region, global secrets.aws.region, or DAGU_SECRETS_AWS_REGION; blocks ARN/region mismatches.
  • Reads string/binary values; supports JSON field extraction via field.

• Bug Fixes

  • Preserve version_id and version_stage exactly as provided; normalize only key and region.
  • Make per-region client caching non-blocking during client creation to prevent lock contention.
  • Stabilize notification monitor tests on Windows with OS-aware timeouts.

^{Written for commit 9c781aa. Summary will update on new commits.}

Summary by CodeRabbit

• New Features
  • Added AWS Secrets Manager as a supported secrets provider.
  • Supports secrets.aws.region, per-secret region overrides, version_id/version_stage, binary secrets, and selecting a specific JSON field from a secret value.
  • Enabled configuration via YAML and DAGU_SECRETS_AWS_REGION.
• Documentation
  • Expanded TLS and Secrets documentation to include AWS secret stores.
• Tests
  • Added/updated AWS Secrets Manager tests (validation, retrieval, JSON field selection, and client caching).
  • Improved notification monitor test timing for stability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a0deb6f6-db57-4e91-854d-51a65e2f4d39

📥 Commits

Reviewing files that changed from the base of the PR and between e9bab68 and 9c781aa.

📒 Files selected for processing (3)

• internal/cmn/secrets/aws_secrets_manager.go
• internal/cmn/secrets/aws_secrets_manager_test.go
• internal/service/chatbridge/monitor_state_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• internal/cmn/secrets/aws_secrets_manager.go
• internal/cmn/secrets/aws_secrets_manager_test.go

---

📝 Walkthrough

Walkthrough

Adds AWS Secrets Manager configuration and a resolver supporting regional clients, version options, binary values, and JSON field extraction. Updates schemas, dependencies, tests, provider registration assertions, documentation, and chatbridge monitor test timeouts.

Changes

AWS Secrets Manager support

Layer / File(s)	Summary
AWS secrets configuration internal/cmn/config/*, internal/cmn/schema/config.schema.json	Adds AWS region configuration through YAML, environment variables, service-scoped settings, typed config, schema definitions, and loader tests.
Secrets Manager resolver and value extraction internal/cmn/secrets/aws_secrets_manager.go, internal/cmn/secrets/field.go, go.mod, README.md	Registers the provider, resolves regional secrets with cached clients, supports versions and binary values, optionally extracts JSON fields, adds AWS SDK dependencies, and documents providers.
Resolver validation and tests internal/cmn/secrets/*_test.go	Tests reference validation, resolution, errors, binary values, client caching, JSON field extraction, and provider registration.
Chatbridge monitor test timing internal/service/chatbridge/monitor_state_test.go	Uses the shared eventual-timeout helper for monitor state, delivery, retry, and destination cleanup assertions.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• dagucloud/dagu#2153: Introduces the secrets resolver and registry architecture used by this provider.
• dagucloud/dagu#2403: Shares JSON field extraction and registry test changes for another cloud secrets provider.
• dagucloud/dagu#2404: Shares JSON field extraction and registry test changes for another cloud secrets provider.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly names the main change: adding an AWS Secrets Manager provider.
Description check	✅ Passed	The description covers summary, testing, and related issue context, and is mostly complete despite the checklist not being explicitly filled out.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/aws-secrets-manager

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Adds an AWS Secrets Manager-backed secret resolver to Dagu’s secret management subsystem, integrating with existing provider registry and configuration loading so DAGs can resolve runtime secrets via AWS SDK default credentials.

Changes:

• Added aws-secrets-manager secret provider with support for name/ARN lookups, version selectors, binary values, and optional JSON field extraction.
• Extended global config + schema to include secrets.aws.region (and DAGU_SECRETS_AWS_REGION) as a default AWS region for secret lookups.
• Added unit tests for the new resolver and JSON field selection helper; updated provider registry tests and README.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Updates documented secret management providers list to include AWS Secrets Manager.
internal/cmn/secrets/resolver_test.go	Updates provider registry tests to expect the new AWS provider.
internal/cmn/secrets/field.go	Adds helper for extracting a top-level field from a JSON secret payload.
internal/cmn/secrets/field_test.go	Adds tests for JSON field extraction behavior and error safety.
internal/cmn/secrets/aws_secrets_manager.go	Implements the AWS Secrets Manager resolver and client caching.
internal/cmn/secrets/aws_secrets_manager_test.go	Adds tests for AWS resolver behavior, options, and caching.
internal/cmn/schema/config.schema.json	Extends config schema with secrets.aws.region.
internal/cmn/config/loader.go	Loads secrets.aws.region into runtime config and binds env var.
internal/cmn/config/loader_test.go	Tests YAML/env loading for the new AWS secrets config section.
internal/cmn/config/definition.go	Adds mapstructure definition types for secrets.aws.*.
internal/cmn/config/config.go	Adds runtime config struct for AWS secrets defaults.
go.mod	Adds AWS SDK v2 modules required for Secrets Manager integration.
go.sum	Updates dependency checksums for the new AWS SDK modules.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/cmn/secrets/aws_secrets_manager.go`:
- Around line 104-124: Update awsSecretsManagerResolver.getClient to avoid
calling factory(ctx, region) while holding r.mu: first check r.clients under the
lock, release it, create the client outside the lock, then reacquire the lock
and recheck the region before caching and returning the existing or newly
created client. Preserve the existing error wrapping and ensure concurrent
initialization cannot overwrite the client selected in the second check.

In `@internal/cmn/secrets/field.go`:
- Around line 31-39: Update the JSON handling in the visible field-processing
function to validate raw JSON without unmarshaling into any or re-marshaling it;
return the original json.RawMessage content directly after validation,
preserving exact numeric representation and formatting.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 29ce3df0-8c99-48c4-983c-c1b48c7703ba

📥 Commits

Reviewing files that changed from the base of the PR and between 8718338 and b2ef09b.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (12)

• README.md
• go.mod
• internal/cmn/config/config.go
• internal/cmn/config/definition.go
• internal/cmn/config/loader.go
• internal/cmn/config/loader_test.go
• internal/cmn/schema/config.schema.json
• internal/cmn/secrets/aws_secrets_manager.go
• internal/cmn/secrets/aws_secrets_manager_test.go
• internal/cmn/secrets/field.go
• internal/cmn/secrets/field_test.go
• internal/cmn/secrets/resolver_test.go

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

[yohamta0]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 4 comments.

[Copilot]

Copilot reviewed 13 out of 14 changed files in this pull request and generated no new comments.

[yohamta0]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[yohamta0]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated no new comments.

[yohamta0]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated no new comments.