feat(secret): add inject command to substitute secret references in template files

[Andarius]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Summary

Adds a scw secret inject command that substitutes {{ scw://REFERENCE }} placeholders in template files or stdin with live secret values fetched from the Scaleway Secret Manager API. Multiple distinct secrets are fetched concurrently.
Similar to op inject and pass-cli inject

Usage

# Render a template to stdout
scw secret inject in-file=config.tmpl

# Write output to a file (default mode 0600)
scw secret inject in-file=config.tmpl out-file=/etc/app/config

# Pipe from stdin
echo "password={{ scw://my-app/db-password }}" | scw secret inject

Reference syntax

Pattern	Meaning
UUID	secret by ID, latest revision
UUID@REVISION	secret by ID, specific revision
UUID:FIELD	secret by ID, extract JSON field
NAME or PATH/NAME	secret by name/path, latest revision
PATH/NAME@REVISION:FIELD	name/path with revision and JSON field

REVISION accepts an integer, latest, or latest_enabled.
FIELD extracts a top-level string key from a JSON-encoded secret value.

Changes

• internal/namespaces/secret/v1beta1/custom_inject.go — new secret inject command; parses all {{ scw://... }} references, fetches them concurrently via errgroup, then renders the output
• internal/namespaces/secret/v1beta1/custom_inject_test.go — unit tests for parsing, resolution, and rendering
• docs/commands/secret.md — generated docs for the new command

feat(secret): add `inject` command to substitute secret references in template files

[jremy42]

os.WriteFile only applies the 0600 mode when it creates the file. If out-file already exists (e.g. 0644), it's overwritten but keeps its old permissions, so the plaintext secret can leak into a world-readable file despite the requested 0600.

Enforce it explicitly:

f, err := os.OpenFile(args.OutFile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, os.FileMode(mode))
if err != nil {
    return nil, fmt.Errorf("writing output file: %w", err)
}
defer f.Close()
if err := f.Chmod(os.FileMode(mode)); err != nil { // O_CREATE doesn't re-chmod existing files
    return nil, fmt.Errorf("setting output file permissions: %w", err)
}
if _, err := f.Write([]byte(rendered)); err != nil {
    return nil, fmt.Errorf("writing output file: %w", err)
}

[Andarius]

Hi @jremy42, should be ok in latest commit.