secret get fails when it cannot write the value (closes #155)

GetSecret and GetSecretWithVersion discarded the result of writing the value to stdout, so a full disk or a failing stdout left the caller with an empty or cut-short file and exit status 0. The write error is now returned, so the command prints it and exits 1. Deviation: a stdout the shell closed before `secret` started still exits 0, because the Go runtime opens /dev/null in its place and the write there succeeds. Model: opus-5-5
2026-10-15 01:32:14 +02:00
parent faf46d12ff
commit b8842b6184
3 changed files with 56 additions and 3 deletions
@@ -142,7 +142,13 @@ contain `//`, or have `..` as a path segment.

 #### `secret get <secret-name> [--version <version>]`

-Retrieves and outputs a secret value to stdout.
+Retrieves and outputs a secret value to stdout. A failed write of the value,
+such as to a file on a full disk, prints the error and exits 1, with two
+exceptions. If the program reading from a pipe has already exited, as in
+`secret get s | true`, the broken-pipe signal (SIGPIPE) ends `secret` with no
+message and the shell reports exit status 141. If the shell closed stdout before
+`secret` started (`secret get s >&-`), the value is written to `/dev/null` and
+`secret get` exits 0.

 - `--version, -v`: Get a specific version (default: current)