fix: preserve rotation baseline on repeated secret gets

[yashaskn8]

Type of change

• Refactor
• New feature
• Bug fix
• Optimization
• Documentation
• CI

Mention the secrets provider

Description

Commands & Configuration to test

Screenshots & Logs

Related Tickets & Documents

• Related Issue #
• Closes #

Was this PR authored or co-authored using generative AI tooling?

Summary by CodeRabbit

• Bug Fixes
  • Fixed secret change detection so repeated tracking or fetching no longer masks changes made by the underlying provider.
  • Secret rotations now correctly establish the latest change-detection baseline.
  • Improved tracking behavior to preserve accurate change history while continuing to update service associations and labels.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f00205b2-cd64-4037-97bb-825281c5df12

📥 Commits

Reviewing files that changed from the base of the PR and between 15baacf and 124f856.

📒 Files selected for processing (2)

• driver.go
• driver_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change preserves the stored secret hash during retracking. Rotation remains responsible for advancing the hash baseline. New tests cover tracking metadata, idempotency, and provider-value change detection.

Changes

Secret tracking baseline

Layer / File(s)	Summary
Preserve the tracking hash baseline driver.go	Existing tracked secrets retain LastHash while tracking updates service names, timestamps, and labels.
Validate retracking and rotation detection driver_test.go	Tests cover hash initialization, metadata updates, idempotent tracking, and detection of changed provider values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: atharvamhaske, sanjay7178

Merge Risk: ⚪ Minimal · up to 124f8

Repeated secret reads now preserve the rotation baseline while successful rotation advances it, preventing provider-side changes from being hidden. Regression coverage supports merging this focused correction.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 70.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preserving the rotation baseline across repeated secret gets.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

⚠️ This pull request shows signs of AI-generated slop (redundant_comments, description_diff_mismatch). It has been flagged by CodeRabbit slop detection and should be reviewed carefully.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}