Resolve secrets in pipeline config outside of the environment. (#3866)

* Resolve secrets in pipeline config outside of the environment.

// TODO: Figure out a better way to handle this, either by making config.Raw() resolve secrets, or by adding a new api RawResolved().
Need to review this with the team.

* lint

cli/azd/pkg/config/config.go

@@ -27,6 +27,8 @@ var vaultPattern = regexp.MustCompile(
 // Configuration data is stored in user's home directory @ ~/.azd/config.json
 type Config interface {
 	Raw() map[string]any
+	// similar to Raw() but it will resolve any vault references
+	ResolvedRaw() map[string]any
 	Get(path string) (any, bool)
 	GetString(path string) (string, bool)
 	GetSection(path string, section any) (bool, error)
@@ -70,6 +72,39 @@ func (c *config) Raw() map[string]any {
 	return c.data
 }
 
+// Gets the raw values stored in the configuration and resolve any vault references
+func (c *config) ResolvedRaw() map[string]any {
+	resolvedRaw := &config{
+		data: map[string]any{},
+	}
+	paths := paths(c.data)
+	for _, path := range paths {
+		// get will always return true (no need to check) because the path was gotten from the raw config
+		value, _ := c.Get(path)
+		if err := resolvedRaw.Set(path, value); err != nil {
+			panic(fmt.Errorf("failed setting resolved raw value: %w", err))
+		}
+	}
+	return resolvedRaw.data
+}
+
+// paths recursively traverses a map and returns a list of all the paths to the leaf nodes.
+// The start parameter is the initial map to start traversing from.
+// It returns a slice of strings representing the paths to the leaf nodes.
+func paths(start map[string]any) []string {
+	var all []string
+	for path, value := range start {
+		if node, isNode := value.(map[string]any); isNode {
+			for _, child := range paths(node) {
+				all = append(all, fmt.Sprintf("%s.%s", path, child))
+			}
+		} else {
+			all = append(all, path)
+		}
+	}
+	return all
+}
+
 // SetSecret stores the secrets at the specified path within a local user vault
 func (c *config) SetSecret(path string, value string) error {
 	if c.vaultId == "" {

cli/azd/pkg/config/file_config_manager_test.go

@@ -97,6 +97,11 @@ func Test_FileConfigManager_GetSetSecrets(t *testing.T) {
 	missingPassword, ok := updatedConfig.GetString("secrets.misingVaultRef")
 	require.False(t, ok)
 	require.Empty(t, missingPassword)
+
+	require.NotEqual(t, updatedConfig.Raw(), updatedConfig.ResolvedRaw())
+	require.Equal(t, azdConfig.Raw(), updatedConfig.Raw())
+	require.Equal(t, azdConfig.ResolvedRaw(), updatedConfig.ResolvedRaw())
+
 }
 
 func Test_FileConfigManager_GetSetSecretsInSection(t *testing.T) {

cli/azd/pkg/pipeline/pipeline_manager.go

@@ -357,7 +357,7 @@ func (pm *PipelineManager) Configure(ctx context.Context) (result *PipelineConfi
 	// Adding environment.AzdInitialEnvironmentConfigName as a secret to the pipeline as the base configuration for
 	// whenever a new environment is created. This means loading the local environment config into a pipeline secret which
 	// azd will use to restore the the config on CI
-	localEnvConfig, err := json.Marshal(pm.env.Config.Raw())
+	localEnvConfig, err := json.Marshal(pm.env.Config.ResolvedRaw())
 	if err != nil {
 		return result, fmt.Errorf("failed to marshal environment config: %w", err)
 	}