Add defineJsonSecret API for structured secret configuration #1745

taeold · 2025-10-16T21:10:27Z

Implements defineJsonSecret() to retrieve JSON objects in Cloud Secret Manager.

Useful for consolidating related secrets (e.g., API keys, webhooks, client IDs) into a single secret, reducing costs and improving organization.

defineJsonSecret is really just a string that the SDK will parse as JSON at runtime. If the value is undefined or not a valid JSON, the call to .value() will immediately throw.

This change also introduces a backward compatible wire protocol changes (backward compatible). A new annotation format will be set to json for json secrets, and CLI can use it to validate the user input as valid JSON at deploy time.

Implements defineJsonSecret() to store JSON objects in Cloud Secret Manager. Useful for consolidating related secrets (e.g., API keys, webhooks, client IDs) into a single secret, reducing costs and improving organization. Features: - Automatic JSON parsing with error handling - Supports object destructuring - Throws on missing or invalid JSON Wire protocol changes (backward compatible): - Added optional format field to ParamSpec/WireParamSpec - JsonSecretParam.toSpec() returns format: "json" as CLI hint - Old CLIs ignore unknown fields, new CLIs can enhance UX - Format is NOT stored in Secret Manager (just in param spec)

gemini-code-assist · 2025-10-16T21:10:45Z

Summary of Changes

Hello @taeold, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a significant enhancement to secret management by providing a dedicated API, defineJsonSecret, for handling JSON-formatted secrets. This allows for more structured and organized storage of configuration data in Cloud Secret Manager, with automatic parsing and validation at runtime. The change also includes a backward-compatible update to the wire protocol to support CLI-side validation of these new JSON secrets.

Highlights

New API: defineJsonSecret: Introduced a new API, defineJsonSecret, to allow storing and retrieving structured JSON objects as secrets in Cloud Secret Manager.
Runtime JSON Parsing: The defineJsonSecret API automatically parses the secret value as JSON at runtime, returning a JavaScript object. It throws an error if the value is undefined or not valid JSON.
CLI Validation Support: A new format: "json" annotation has been added to the secret parameter specification, enabling the CLI to validate user input as valid JSON during deployment.
Improved Secret Organization: This feature allows developers to consolidate related configuration values (e.g., API keys, webhooks) into a single secret, improving organization and potentially reducing costs.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a new defineJsonSecret API for handling structured JSON secrets, which is a valuable addition. The implementation is well-tested and follows existing patterns in the codebase. My review includes suggestions to improve the new API's type safety by making it generic, which would enhance the developer experience. I've also recommended clarifying the documentation regarding error handling.

src/params/index.ts

src/params/types.ts

taeold · 2025-10-16T22:48:53Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces a new defineJsonSecret API for handling structured JSON secrets, which is a great addition for managing complex configurations. The implementation is solid, with good documentation and comprehensive tests covering various scenarios. I have a couple of minor suggestions to improve debuggability and documentation consistency.

src/params/types.ts

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

jhuleatt · 2025-10-17T00:38:53Z

spec/params/params.spec.ts

+  it("handles empty object JSON", () => {
+    const jsonSecret = params.defineJsonSecret("EMPTY_OBJECT");
+    const value = jsonSecret.value();
+    expect(value).to.deep.equal({});
+  });


is this the behavior we want? maybe we should error on empty JSON

Given that user would've have to store {} in SCM, I feel kinda okay not throwing.

src/params/index.ts

taeold added 2 commits October 16, 2025 12:58

Add changelog entry for defineJsonSecret API

00c6245

github-project-automation bot added this to [Cloud] Extensions + Functions Oct 16, 2025

gemini-code-assist bot reviewed Oct 16, 2025

View reviewed changes

src/params/index.ts Outdated Show resolved Hide resolved

src/params/index.ts Show resolved Hide resolved

src/params/types.ts Outdated Show resolved Hide resolved

taeold requested a review from jhuleatt October 16, 2025 21:55

Add generic type parameter to defineJsonSecret for type safety

6e5d68b

taeold force-pushed the dl-json-secrets branch from aae7dd4 to 6e5d68b Compare October 16, 2025 22:47

Merge branch 'master' into dl-json-secrets

5285d5c

gemini-code-assist bot reviewed Oct 16, 2025

View reviewed changes

src/params/types.ts Show resolved Hide resolved

src/params/types.ts Outdated Show resolved Hide resolved

taeold and others added 2 commits October 16, 2025 15:56

Update src/params/types.ts

3284e98

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Update src/params/types.ts

83d3e32

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

jhuleatt reviewed Oct 17, 2025

View reviewed changes

src/params/index.ts Outdated Show resolved Hide resolved

jhuleatt approved these changes Oct 17, 2025

View reviewed changes

github-project-automation bot moved this to Approved [PR] in [Cloud] Extensions + Functions Oct 17, 2025

nit: doc comments.

551c375

taeold added this pull request to the merge queue Oct 17, 2025

Merged via the queue into master with commit bc7c89a Oct 17, 2025
18 checks passed

github-project-automation bot moved this from Approved [PR] to Done in [Cloud] Extensions + Functions Oct 17, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add defineJsonSecret API for structured secret configuration #1745

Add defineJsonSecret API for structured secret configuration #1745

Uh oh!

taeold commented Oct 16, 2025 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Oct 16, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

taeold commented Oct 16, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

jhuleatt Oct 17, 2025

Uh oh!

taeold Oct 17, 2025

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Add defineJsonSecret API for structured secret configuration #1745

Add defineJsonSecret API for structured secret configuration #1745

Uh oh!

Conversation

taeold commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Oct 16, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

taeold commented Oct 16, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

jhuleatt Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

taeold Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

taeold commented Oct 16, 2025 •

edited

Loading