Repository navigation
fix(posixage)!: return empty map from Filter and GetAllMetadata when nothing matches - #726
Merged
Merged
Conversation
docker-agent
left a comment
docker-agent
left a comment
Contributor
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
Benehiko
force-pushed
the
chore/secrets-module
branch
from
October 30, 2026 13:42
8861c83 to
eefca35
Compare
Benehiko
force-pushed
the
fix/posixage-empty-filter
branch
from
October 30, 2026 13:49
8228129 to
e9f45ce
Compare
Benehiko
force-pushed
the
chore/secrets-module
branch
from
October 30, 2026 13:56
eefca35 to
2aaad38
Compare
Benehiko
force-pushed
the
fix/posixage-empty-filter
branch
from
October 30, 2026 13:57
e9f45ce to
30b9751
Compare
…nothing matches The posixage backend's Filter and GetAllMetadata returned secrets.ErrNotFound when no secret matched, both on an empty store and when secrets existed but none matched the pattern. The keychain backends on macOS, Linux and Windows and the mock stores return an empty (non-nil) map with a nil error in the same situation, as documented on secrets.Store.Filter. 8f21b34 and 4a163cd aligned the Linux keychain the same way; posixage was missed. Drop both guards. Add regression tests for Filter on an empty store, Filter with no matching secret, and GetAllMetadata on an empty store. BREAKING CHANGE: posixage Filter and GetAllMetadata no longer return secrets.ErrNotFound (store.ErrCredentialNotFound) when nothing matches; callers checking for that error on empty results must handle an empty map instead. Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Benehiko
force-pushed
the
fix/posixage-empty-filter
branch
from
October 30, 2026 14:45
30b9751 to
749e998
Compare
Benehiko
enabled auto-merge
October 30, 2026 14:55
Benehiko
disabled auto-merge
October 30, 2026 14:55
joe0BAB
approved these changes
Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
secrets.Store.Filterdocuments that a pattern matching nothing is a valid empty result: an empty (non-nil) map and a nil error, notErrNotFound. Every backend follows that except posixage, which returnsnil, secrets.ErrNotFoundfrom bothFilterandGetAllMetadatawhen nothing matches.store/mocks,plugins/pass/teststoreErrNotFoundErrNotFoundThe contract was added in 8f21b34, which aligned
Filteron the Linux keychain, after 4a163cd did the same forGetAllMetadata. posixage was missed both times. This is not a regression from #725: before it, posixage returnedstore.ErrCredentialNotFoundhere, the same error value.The change drops the two
len(results) == 0guards.resultsis already a non-nil map.Breaking: callers that check
errors.Is(err, secrets.ErrNotFound)(orstore.ErrCredentialNotFound) after posixageFilterorGetAllMetadatamust handle an empty map instead. Nothing in this repo does; posixage is only used by its own tests here.Verification
TestPOSIXAge:Filteron an empty store,Filterwith no matching secret,GetAllMetadataon an empty store. All three fail without the fix (secret not found) and pass with it.go test -race ./store/posixage/...passes onmainafter chore: lift x/secrets into a dependency-free secrets module #725.go vetfor darwin, linux and windows;golangci-linton darwin: 0 issues.Out of scope, noted for later: posixage
Geton a missing ID returns the underlying file-system error rather thansecrets.ErrNotFound, andDeleteon a missing ID returns nil. So after this change posixage never returnsErrNotFound, unlike the keychain backends, which reserve it for single-item lookups.AI disclosure: drafted with an AI coding agent (alki, Claude) under my direction; I reviewed the changes.