[smecsia]

Summary

Fifth slice (D5) of the sc-secrets-bundle-mode initiative — see forge/docs/design/2026-10-17/sc-secrets-bundle-mode/README.md for the full design.

Adds LoadSecretBundle(ctx) to pkg/awsutil/secrets.go: reads a FORGE_SECRETS_BUNDLE_ARN env (the SecretsBundleEnv constant), fetches the JSON payload via the existing secretcache.Cache, parses it as {envName:string → value:string}, and os.Setenv's each key.

SC's Pulumi renderer (D3/D4 in the api repo) is the sibling change that writes the FORGE_SECRETS_BUNDLE_ARN env + the ONE Secrets Manager JSON secret per service. Together, N per-key ARN envs become 1 — reclaims ~4-5 KB on the forge-conductor Lambda, which has been at the 4KB env cap since 2026-10-16.

Contract preserved for the rest of the fleet

• Unset FORGE_SECRETS_BUNDLE_ARN = NO-OP (nil error). This SDK version can be pinned before any service opts in on the SC side. Legacy per-key GetEnvOrSecret works unchanged.
• Set-but-not-ARN = loud error. is set but is not a Secrets Manager ARN (got prefix "..."). Operator typos surface instead of loading garbage.
• Operator-pinned env values win. os.Setenv skips keys already set in the environment — anything the operator pinned via env: in client.yaml overrides the bundle.
• Non-string JSON values rejected. Explicit error rather than silent Go-default stringification.
• Shared cache. Rides the same lazy secretcache.Cache GetEnvOrSecret uses. No second AWS session. On Yandex (no bundle env, no AWS creds) the cache stays unbuilt.

Also adds LoadSecretBundleFromEnv(ctx, envName) for services that need a different bundle env name during staged migrations.

Call-site contract

Services opt in by adding ONE line to the top of main():

if err := awsutil.LoadSecretBundle(context.Background()); err != nil {
    log.Fatalf("secret bundle load: %v", err)
}

Everything downstream continues to call GetEnvOrSecret / os.Getenv unchanged.

Test plan

• TestLoadSecretBundleUnsetIsNoop — unset bundle env is a no-op (nil error)
• TestLoadSecretBundleRejectsNonArn — garbage value surfaces as "not a Secrets Manager ARN"
• TestLoadSecretBundleFromEnvRespectsExplicitEnvName — explicit env-name variant works
• TestFirstN — error-message truncation helper
• Existing TestGetEnvOrSecretReturnsLiteralWithoutTouchingAws + TestGetEnvOrSecretReturnsEmptyForUnsetVariable still pass
• go vet + go build + gofumpt -w + gci write applied
• Live-smoked once the api-side D2+D3 lands and forge-conductor D6 pilot runs

References

• Design doc: forge/docs/design/2026-10-17/sc-secrets-bundle-mode/README.md
• Roadmap item: forge/docs/roadmap/items/sc-secrets-bundle-mode.md (slice D5)
• Blocked siblings waiting for env-cap reclamation: forge-conductor conductor-lambda-env-4kb-cap, Resend webhook pivot PR #601 workaround

[github-actions]

Semgrep Scan Results

Repository: go-aws-lambda-sdk | Commit: dd5d959

Check	Status	Details
🚨 Semgrep	ERROR	1 error(s), 2 warning(s), 3 total

Scanned at 2026-10-17 13:57 UTC

[github-actions]

Security Scan Results

Repository: go-aws-lambda-sdk | Commit: dd5d959

Check	Status	Details
✅ Secret Scan	Pass	No secrets detected
❌ Dependencies	Failed	Check workflow logs

Scanned at 2026-10-17 14:00 UTC