From 54e343a35bbaac5a5222a0e0df15d310a84438cc Mon Sep 17 00:00:00 2001
From: Fraser Waters <fraser@pulumi.com>
Date: Fri, 15 Nov 2024 13:03:09 +0000
Subject: [PATCH] Enable the l2-invoke-secrets test

---
 .changes/unreleased/Bug Fixes-683.yaml        |  6 ++++
 cmd/pulumi-language-yaml/language_test.go     |  1 -
 .../projects/l2-invoke-secrets/Main.yaml      | 32 +++++++++++++++++++
 .../projects/l2-invoke-secrets/Pulumi.yaml    |  2 ++
 .../l2-invoke-secrets/sdks/simple-invoke.yaml |  3 ++
 .../l2-invoke-secrets/sdks/simple.yaml        |  3 ++
 pkg/pulumiyaml/codegen/gen_program.go         |  2 ++
 7 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 .changes/unreleased/Bug Fixes-683.yaml
 create mode 100644 cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/Main.yaml
 create mode 100644 cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/Pulumi.yaml
 create mode 100644 cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/sdks/simple-invoke.yaml
 create mode 100644 cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/sdks/simple.yaml

diff --git a/.changes/unreleased/Bug Fixes-683.yaml b/.changes/unreleased/Bug Fixes-683.yaml
new file mode 100644
index 00000000..b4752ee3
--- /dev/null
+++ b/.changes/unreleased/Bug Fixes-683.yaml	
@@ -0,0 +1,6 @@
+component: codegen
+kind: Bug Fixes
+body: Recognize the PCL fn::secret function
+time: 2024-11-15T13:03:54.975607828Z
+custom:
+  PR: "683"
diff --git a/cmd/pulumi-language-yaml/language_test.go b/cmd/pulumi-language-yaml/language_test.go
index 51eaf748..2076bc3a 100644
--- a/cmd/pulumi-language-yaml/language_test.go
+++ b/cmd/pulumi-language-yaml/language_test.go
@@ -176,7 +176,6 @@ var expectedFailures = map[string]string{
 	"l2-invoke-options":                     "cannot assign expression",
 	"l2-map-keys":                           "missing expected dependency primitive",
 	"l2-provider-grpc-config-schema-secret": "Detected a secret leak in state",
-	"l2-invoke-secrets":                     "YAML does not support fn::secret",
 	"l2-parameterized-resource":             "could not load schema for subpackage, provider not known",
 	"l2-failed-create-continue-on-error":    "missing expected dependency fail_on_create",
 	"l2-invoke-dependencies":                "missing expected dependency simple-invoke",
diff --git a/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/Main.yaml b/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/Main.yaml
new file mode 100644
index 00000000..e9f6209c
--- /dev/null
+++ b/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/Main.yaml
@@ -0,0 +1,32 @@
+resources:
+  res:
+    type: simple:Resource
+    properties:
+      value: true
+outputs:
+  # inputs are plain and the invoke response is plain
+  nonSecret:
+    fn::invoke:
+      Function: simple-invoke:secretInvoke
+      Arguments:
+        value: hello
+        secretResponse: false
+      Return: response
+  # referencing value from resource
+  # // invoke response is secret => whole output is secret
+  firstSecret:
+    fn::invoke:
+      Function: simple-invoke:secretInvoke
+      Arguments:
+        value: hello
+        secretResponse: ${res.value}
+      Return: response
+  # inputs are secret, invoke response is plain => whole output is secret
+  secondSecret:
+    fn::invoke:
+      Function: simple-invoke:secretInvoke
+      Arguments:
+        value:
+          fn::secret: goodbye
+        secretResponse: false
+      Return: response
diff --git a/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/Pulumi.yaml b/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/Pulumi.yaml
new file mode 100644
index 00000000..297c856f
--- /dev/null
+++ b/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/Pulumi.yaml
@@ -0,0 +1,2 @@
+name: l2-invoke-secrets
+runtime: yaml
diff --git a/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/sdks/simple-invoke.yaml b/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/sdks/simple-invoke.yaml
new file mode 100644
index 00000000..edbd5f88
--- /dev/null
+++ b/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/sdks/simple-invoke.yaml
@@ -0,0 +1,3 @@
+packageDeclarationVersion: 1
+name: simple-invoke
+version: 10.0.0
diff --git a/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/sdks/simple.yaml b/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/sdks/simple.yaml
new file mode 100644
index 00000000..f357f94b
--- /dev/null
+++ b/cmd/pulumi-language-yaml/testdata/projects/l2-invoke-secrets/sdks/simple.yaml
@@ -0,0 +1,3 @@
+packageDeclarationVersion: 1
+name: simple
+version: 2.0.0
diff --git a/pkg/pulumiyaml/codegen/gen_program.go b/pkg/pulumiyaml/codegen/gen_program.go
index 7ddcf946..8813bbe1 100644
--- a/pkg/pulumiyaml/codegen/gen_program.go
+++ b/pkg/pulumiyaml/codegen/gen_program.go
@@ -735,6 +735,8 @@ func (g *generator) function(f *model.FunctionCallExpression) syn.Node {
 		return wrapFn("select", syn.List(args[1], args[0]))
 	case "readFile":
 		return wrapFn("readFile", g.expr(f.Args[0]))
+	case "secret":
+		return wrapFn("secret", g.expr(f.Args[0]))
 	case pcl.IntrinsicConvert:
 		// We can't perform the convert, but it might happen automatically.
 		// This works for enums, as well as number -> strings.