Stringify AWS Secrets Manager values

[seeday]

When working with the AWS Secrets Manager, secrets that are stored as JSON are subject to unexpected type changes. In particular, when calling kamal secrets extract JSON objects that contain integers get unconditionally #chomp-ed, causing a crash.

Fix

This fix JSON.dumps non-string values to allow chomp to succeed, and also should produce fewer surprises for end users via better handling of JSON values.

This issue is related to #1816 (they hit the primitive-only path) and should fix it as well. For non-hash secret strings, we simply stringify the whole thing.

Edge Cases

• For null handling, I chose to emit the string null. I feel like this produces fewer surprises than an empty string or omission.
• Quoted strings in a secret will have their quotes stripped as they are JSON.parseable.

Alternatives

• I considered supporting recursive JSON documents. "Flat" secrets are most common, and this would require extra cli options if the value was needed raw instead of parsed.
• Rejecting or omitting non-primitives.
• Calling #to_s instead of JSON.dump. This produces odd behavior with complex JSON types and null.

[Copilot]

Pull request overview

This PR fixes AWS Secrets Manager secret extraction to avoid Ruby 4.0+ JSON.parse returning non-Hash primitives (e.g., integers/booleans/null) and crashing the adapter when iterating, while also normalizing parsed JSON values to strings for more predictable downstream handling.

Changes:

• Guard JSON.parse results in the AWS Secrets Manager adapter to only expand secrets when the parsed value is a Hash.
• Stringify non-string JSON values via JSON.dump to ensure secret values behave consistently as strings.
• Add regression tests covering bare JSON primitives and non-string JSON fields within JSON objects.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
lib/kamal/secrets/adapters/aws_secrets_manager.rb	Prevents crashes on non-Hash JSON.parse results and coerces parsed values to strings for downstream consumers.
test/secrets/aws_secrets_manager_adapter_test.rb	Adds coverage for bare JSON primitive secrets and coercion behavior for non-string JSON object fields.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.