name: secrets-management
description: Document secrets management and secure credential handling
version: "1.0"
applies_to:
  - codebase_analysis
variables:
  depth: comprehensive
stages:
  - name: secrets_inventory
    type: custom
    target: inventory
    uses_history: false
    enabled: true
    prompt: >
      Document secrets inventory and types.
      
      Identify:
      1. Types of secrets used (API keys, DB passwords, tokens)
      2. Secret storage locations
      3. Secret rotation frequency
      4. Secret access patterns
      5. Hardcoded secret detection
      
      Output JSON with:
      - "secret_types": categories of secrets
      - "storage": where secrets are stored
      - "rotation": rotation schedule
      - "hardcoded_check": detecting secrets in code

  - name: vault_setup
    type: custom
    target: vault
    uses_history: false
    enabled: true
    prompt: >
      Document secrets vault implementation.
      
      Cover:
      1. Vault choice (HashiCorp Vault, AWS Secrets Manager, etc.)
      2. Secret versioning
      3. Access control (who can access what)
      4. Audit logging of secret access
      5. Dynamic secrets (if applicable)
      
      Output JSON with:
      - "vault_platform": vault solution
      - "versioning": secret versioning
      - "access_control": permission structure
      - "audit": access logging

  - name: runtime_injection
    type: custom
    target: injection
    uses_history: true
    enabled: true
    prompt: >
      Document runtime secret injection patterns.
      
      Include:
      1. Environment variable injection
      2. Sidecar injection patterns
      3. Init container secret fetching
      4. Secret mounting (files vs env vars)
      5. Runtime secret caching
      
      Output JSON with:
      - "env_injection": environment variables
      - "sidecar": sidecar patterns
      - "mounting": secret mounting
      - "caching": runtime caching

  - name: secrets_rotation
    type: custom
    target: rotation
    uses_history: true
    enabled: true
    prompt: >
      Document secret rotation strategy.
      
      Cover:
      1. Automated rotation policies
      2. Zero-downtime rotation
      3. Emergency rotation procedures
      4. Rotation verification
      5. Revocation procedures
      
      Output JSON with:
      - "rotation_policy": rotation schedule
      - "zero_downtime": seamless rotation
      - "emergency": emergency procedures
      - "verification": confirming rotation

post_process:
  reorder_sections: []
  add_metadata:
    enhanced: true
    workflow: secrets-management
    domain: security
