Optional provider builds via Go build tags

[vlsi]

Summary

• Introduce a provider registry and Go build tags so that heavy providers can be excluded at compile time
• Make the Yandex Cloud (yclockbox) provider optional as the first candidate — its SDK + transitive deps (gRPC stubs, envoyproxy, etc.) are the largest contributor to binary size
• Add CI step to verify minimal build keeps compiling

Impact

Build	Stripped size	Change
Default (all providers)	140 MB	—
-tags custom_providers	98 MB	−42 MB (−30%)

Usage

go build ./cmd/vals                                   # all providers (unchanged)
go build -tags custom_providers ./cmd/vals            # exclude optional providers
go build -tags "custom_providers,yandex" ./cmd/vals   # opt-in yclockbox
go build -tags all_providers ./cmd/vals               # explicitly all

How it works

• pkg/providers/registry — a simple map-based provider registry with Register() / Get()
• register_yclockbox.go (//go:build yandex || all_providers || !custom_providers) — registers the provider via init()
• register_yclockbox_noop.go (//go:build custom_providers && !yandex && !all_providers) — empty stub
• vals.go — the createProvider switch now falls back to the registry for optional providers
• The same pattern can be applied to other heavy providers (1Password, K8s, etc.) in follow-up PRs

Test plan

• go build ./... — full build compiles as before
• go build -tags custom_providers ./... — minimal build compiles without yclockbox
• go test ./... — no new test failures in either mode
• CI step added to verify minimal build on every PR

See also

• lockbox consumes 40MiB binary size yandex-cloud/go-sdk#42. It would be nice if yclockbox binary size could be reduced as well

  Fixes Optional provider builds via Go build tags #1054

[Copilot]

Pull request overview

This PR introduces a provider registry plus Go build tags to make provider inclusion configurable at compile time, enabling smaller vals binaries by excluding provider implementations (and their heavy transitive dependencies) unless explicitly opted in.

Changes:

• Replaced large provider-construction switches with a registry-based lookup (for main providers, string providers, and string-map providers).
• Added build-tagged register_*.go files (in package vals) that register providers via init() depending on build tags.
• Added a CI step to ensure a minimal build (-tags custom_providers) compiles.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
vals.go	Switch-based provider creation reduced to core providers; all others resolved via the new registry.
register_aws.go	Build-tagged registration for AWS providers (s3/ssm/awssecrets/awskms) + string/string-map variants.
register_azure.go	Build-tagged registration for Azure Key Vault provider + string/string-map variants.
register_bitwarden.go	Build-tagged registration for Bitwarden provider.
register_conjur.go	Build-tagged registration for Conjur provider + string provider.
register_doppler.go	Build-tagged registration for Doppler provider + string/string-map variants.
register_gcp.go	Build-tagged registration for GCS/GCP Secret Manager/GKMS/Google Sheets + string/string-map variants.
register_gitlab.go	Build-tagged registration for GitLab provider + string provider.
register_hcpvaultsecrets.go	Build-tagged registration for HCP Vault Secrets provider + string provider.
register_httpjson.go	Build-tagged registration for httpjson provider + string/string-map variants.
register_infisical.go	Build-tagged registration for Infisical provider + string/string-map variants.
register_k8s.go	Build-tagged registration for Kubernetes provider + string/string-map variants.
register_keychain.go	Build-tagged registration for Keychain provider.
register_oci.go	Build-tagged registration for OCI provider + string provider.
register_onepassword.go	Build-tagged registration for 1Password + 1Password Connect providers + string/string-map variants.
register_openbao.go	Build-tagged registration for OpenBao provider.
register_pulumi.go	Build-tagged registration for Pulumi State API provider + string provider.
register_scaleway.go	Build-tagged registration for Scaleway provider + string/string-map variants.
register_secretserver.go	Build-tagged registration for Secret Server provider + string provider.
register_servercore.go	Build-tagged registration for Servercore provider.
register_sops.go	Build-tagged registration for SOPS provider + string/string-map variants.
register_terraform.go	Build-tagged registration for Terraform state providers + string providers.
register_vault.go	Build-tagged registration for Vault provider + string/string-map variants.
register_yclockbox.go	Build-tagged registration for Yandex Lockbox (yclockbox) provider.
pkg/stringprovider/stringprovider.go	String provider factory selection moved to registry lookup (except exec).
pkg/stringmapprovider/stringmapprovider.go	String-map provider factory selection moved to registry lookup (except exec).
pkg/providers/registry/registry.go	New central provider/string/string-map registry used by core code and build-tagged registration.
.github/workflows/ci.yaml	Added a minimal-build compilation check using -tags custom_providers.

Comments suppressed due to low confidence (2)

pkg/stringmapprovider/stringmapprovider.go:25

• When a string-map provider isn't registered (e.g., excluded via build tags), the function returns the generic error failed initializing string-map provider from config: ..., which doesn't clearly say the provider name is unknown/unavailable. Consider returning a dedicated error when registry.GetStringMapProvider(tpe) is false that includes tpe (and possibly hints that it may be excluded at build time).

	default:
		if factory, ok := registry.GetStringMapProvider(tpe); ok {
			return factory(l, provider, awsLogLevel)
		}
	}

	return nil, fmt.Errorf("failed initializing string-map provider from config: %v", provider)
}

pkg/stringprovider/stringprovider.go:25

• When a string provider isn't registered (e.g., because it was excluded via build tags), the function falls through to the generic error failed initializing string provider from config: ..., which doesn’t clearly indicate that the provider name is unknown/unavailable. Consider returning a dedicated error when registry.GetStringProvider(tpe) is false that includes tpe (and possibly hints that it may be excluded at build time).

	default:
		if factory, ok := registry.GetStringProvider(tpe); ok {
			return factory(l, provider, awsLogLevel)
		}
	}

	return nil, fmt.Errorf("failed initializing string provider from config: %v", provider)
}

[vlsi]

I've added clarification to README regarding the way to build the library.
custom_providers excludes all optional by default, so the ones who want custom builds would use custom_providers,valut,gcp,... and the other required parameters.

[vlsi]

I've did a couple of changes:

1. Codex reviewed the initial changes and surfaced that 1fcb5e3 did not support "importing providers directly". In other words, previously, users could import individual providers without importing top-level vals. So I addressed the concern and moved init/registration.
2. I've added README regarding the build
3. I've fixed s3 vs ssm which looks like a true bug (it was there before the PR as well)

[vlsi]

@yxxhero , a gentle ping. Is there anything I could do to help with getting this merged?