feat(credential): implement the secret process (#7882)

[Gabriel Pezé (gabriel-peze)]

Proposed changes

• Add the process to retrieve the credentials and convert them into files and vars envs by credential types

Related issues

• Relates #7882

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality
• For bug fix -> I implemented a test that covers the bug

[Christophe Melchior (Kakudou)]

The implementation have been done and tested in both stratus (OpenAEV-Platform/injectors#472) and prowler (OpenAEV-Platform/injectors#471).

I've added a selector 'credentials' to the contract, allowing to switch from the new creds manager to the old manual way:

i've created a creds for aws:

and tested it in various prowler contracts:

and it works:

[Copilot]

🟡 Changes recommended

Redirects can disclose authorisation codes, and malformed inputs can bypass validation or error mapping.

3 open findings

• Disable redirects to prevent credential leakage on cross-host 307/308 · New
• Reject malformed credential references instead of using legacy authentication · New
• Handle non-string error messages without raising AttributeError · New

What changed in this PR

Adds execution-time credential resolution to the Python client, converting platform secrets into cloud-specific environment variables and temporary files.

Changes:

• Adds attachment resolution, typed secrets, compatibility checks, and error mapping.
• Adds AWS, Azure, and GCP credential materialization with temporary-file cleanup.
• Tests resolution, validation, materialization, and secret redaction.

File	Description
test/​credential/​test_credential_resolved.py	Tests secret parsing and compatibility.
test/​credential/​test_credential_materializer.py	Tests cloud outputs and cleanup.
test/​credential/​test_credential_errors.py	Tests error codes and guidance.
test/​credential/​test_credential_attachment.py	Tests attachment parsing and resolution.
test/​apis/​inject/​test_inject.py	Tests secret-resolution requests and failures.
test/​apis/​inject/​__init__.py	Adds the test package marker.
pyoaev/​credential/​types.py	Defines secret-related enums.
pyoaev/​credential/​resolved.py	Adds typed secrets and validation.
pyoaev/​credential/​materializer.py	Generates cloud environments and temporary files.
pyoaev/​credential/​errors.py	Defines credential errors and operator guidance.
pyoaev/​credential/​attachment.py	Resolves job credential attachments.
pyoaev/​credential/​__init__.py	Exports credential APIs.
pyoaev/​apis/​inject.py	Adds the secret-resolution endpoint method.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.