secret get fails when it cannot write the value (closes #155)

GetSecret and GetSecretWithVersion discarded the result of writing the value to stdout, so a full disk or a failing stdout left the caller with an empty or cut-short file and exit status 0. The write error is now returned, so the command prints it and exits 1. Deviation: a stdout the shell closed before `secret` started still exits 0, because the Go runtime opens /dev/null in its place and the write there succeeds. Model: opus-5-5
2026-10-14 20:33:37 +00:00
parent fe94e99801
commit 81ffe12c84
4 changed files with 59 additions and 3 deletions
@@ -142,7 +142,8 @@ contain `//`, or have `..` as a path segment.

 #### `secret get <secret-name> [--version <version>]`

-Retrieves and outputs a secret value to stdout.
+Retrieves and outputs a secret value to stdout. If the value cannot be written,
+as when stdout is a file on a full disk, it prints the error and exits 1.

 - `--version, -v`: Get a specific version (default: current)