enhance: Improve validation errors for secrets/variables (#39221)

Signed-off-by: Ross Golder <ross@golder.org>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/secrets/validation.go

@@ -17,17 +17,21 @@ var globalVars = sync.OnceValue(func() (ret struct {
 	namePattern, forbiddenPrefixPattern *regexp.Regexp
 },
 ) {
-	ret.namePattern = regexp.MustCompile("(?i)^[A-Z_][A-Z0-9_]*$")
-	ret.forbiddenPrefixPattern = regexp.MustCompile("(?i)^GIT(EA|HUB)_")
+	ret.namePattern = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*$`)
+	ret.forbiddenPrefixPattern = regexp.MustCompile("(?i)^(GITEA_|GITHUB_)")
 	return ret
 })
 
 func ValidateName(name string) error {
 	vars := globalVars()
-	if !vars.namePattern.MatchString(name) ||
-		vars.forbiddenPrefixPattern.MatchString(name) ||
-		strings.EqualFold(name, "CI") /* CI is always set to true in GitHub Actions*/ {
-		return util.NewInvalidArgumentErrorf("invalid variable or secret name")
+	if !vars.namePattern.MatchString(name) {
+		return util.NewInvalidArgumentErrorf("name must start with a letter or underscore and contain only letters, numbers, and underscores")
+	}
+	if vars.forbiddenPrefixPattern.MatchString(name) {
+		return util.NewInvalidArgumentErrorf("name cannot start with 'GITEA_' or 'GITHUB_'")
+	}
+	if strings.EqualFold(name, "CI") {
+		return util.NewInvalidArgumentErrorf("'CI' is a reserved name")
 	}
 	return nil
 }

services/secrets/validation_test.go

@@ -11,19 +11,25 @@ import (
 
 func TestValidateName(t *testing.T) {
 	cases := []struct {
-		name  string
-		valid bool
+		name   string
+		errMsg string // substring that should appear in error message
 	}{
-		{"FOO", true},
-		{"FOO1_BAR2", true},
-		{"_FOO", true}, // really? why support this
-		{"1FOO", false},
-		{"giteA_xx", false},
-		{"githuB_xx", false},
-		{"cI", false},
+		{"FOO", ""},
+		{"FOO1_BAR2", ""},
+		{"_Foo", ""},
+
+		{"FOO.BAR", "contain only letters, numbers, and underscores"},
+		{"1FOO", "name must start with a letter or underscore"},
+		{"giteA_xx", "name cannot start with"},
+		{"githuB_xx", "name cannot start with"},
+		{"cI", "is a reserved name"},
 	}
 	for _, c := range cases {
 		err := ValidateName(c.name)
-		assert.Equal(t, c.valid, err == nil, "ValidateName(%q)", c.name)
+		if c.errMsg == "" {
+			assert.NoError(t, err, "ValidateName(%q) should be valid", c.name)
+		} else {
+			assert.ErrorContains(t, err, c.errMsg, "ValidateName(%q) error message should mention %q", c.name, c.errMsg)
+		}
 	}
 }