stack/dev/scripts/sync_secrets.py

"""Sync environment variables to Databricks secret scopes.

Reads the ``[databricks.secrets]`` section from ``stack.toml``
and pushes matching environment variables into a Databricks scope
via the SDK.

Usage::

    uv run python dev/scripts/sync_secrets.py            # sync
    uv run python dev/scripts/sync_secrets.py --dry-run   # preview
    uv run python dev/scripts/sync_secrets.py --list      # show current secrets
"""

from __future__ import annotations

import argparse
import sys

from conf import cfg


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument(
        "--dry-run", action="store_true", help="preview without changes"
    )
    parser.add_argument(
        "--list", action="store_true", help="list current secrets in scope"
    )
    args = parser.parse_args()

    secrets_cfg = getattr(cfg.databricks, "secrets", None)
    if not secrets_cfg:
        print("No [databricks.secrets] section in stack.toml")
        return 1

    scope = secrets_cfg.scope
    mapping_list = secrets_cfg.mapping or []

    # Build env→key mapping
    mapping = {item["env"]: item["key"] for item in mapping_list}

    if not mapping:
        print("No secret mappings defined in [databricks.secrets]")
        return 0

    from aco.lake.unity import UnityClient

    client = UnityClient.from_env()

    if args.list:
        try:
            keys = client.list_secrets(scope)
            print(f"Secrets in scope '{scope}':")
            for k in keys:
                print(f"  {k}")
            if not keys:
                print("  (empty)")
        except Exception as e:
            print(f"Error listing secrets: {e}")
        return 0

    actions = client.sync_secrets(scope, mapping, dry_run=args.dry_run)
    for action in actions:
        print(action)

    return 0


if __name__ == "__main__":
    sys.exit(main())