Propagate matched sensitivity with one work queue

internal/engine/secret_propagation.go

@@ -6,6 +6,13 @@ type secretTrigger struct {
 }
 
 func closeSecretDependencies(paths map[string]Path, sensitive map[string]bool, dependencies, inherited []secretDependency) map[string]bool {
+	return closeSecretDependenciesWithCorrespondence(paths, sensitive, dependencies, inherited, resolutionCorrespondence{})
+}
+
+// Matching adds endpoint edges to the same work queue as recorded dependencies.
+// Newly reached coordinates are indexed once, including historical fields that
+// have no physical descendant at the corresponding final position.
+func closeSecretDependenciesWithCorrespondence(paths map[string]Path, sensitive map[string]bool, dependencies, inherited []secretDependency, correspondence resolutionCorrespondence) map[string]bool {
 	result := make(map[string]bool, len(sensitive))
 	queue := make([]string, 0, len(sensitive))
 	for pointer, classified := range sensitive {
@@ -17,12 +24,14 @@ func closeSecretDependencies(paths map[string]Path, sensitive map[string]bool, d
 
 	var triggers pathPrefixIndex
 	triggerValues := make([]secretTrigger, 0, len(dependencies)+2*len(inherited))
+	fired := make([]bool, 0, cap(triggerValues))
 	insert := func(dependency Path, target string, ordinary bool) {
 		if ordinary && !dependency.valid() {
 			return
 		}
 		id := len(triggerValues)
 		triggerValues = append(triggerValues, secretTrigger{target: target, ordinary: ordinary})
+		fired = append(fired, false)
 		triggers.insert(dependency.String(), id)
 	}
 	for _, dependency := range dependencies {
@@ -33,7 +42,46 @@ func closeSecretDependencies(paths map[string]Path, sensitive map[string]bool, d
 		insert(link.target, link.dependency.String(), false)
 	}
 
-	fired := make([]bool, len(triggerValues))
+	var projected map[string]bool
+	if len(correspondence.collections) != 0 {
+		projected = make(map[string]bool, len(paths))
+	}
+	project := func(path Path) {
+		if projected == nil || !path.valid() {
+			return
+		}
+		pointer := path.String()
+		if projected[pointer] {
+			return
+		}
+		projected[pointer] = true
+		add := func(target Path, matched bool) {
+			if !matched {
+				return
+			}
+			targetPointer := target.String()
+			if targetPointer == pointer {
+				return
+			}
+			if _, exists := paths[targetPointer]; !exists {
+				paths[targetPointer] = target
+			}
+			insert(path, targetPointer, false)
+		}
+		add(correspondence.finalPath(path))
+		add(correspondence.entryPath(path))
+	}
+	if projected != nil {
+		// Projection may add missing target coordinates to paths. Snapshot the
+		// original candidates so map insertion cannot affect this traversal.
+		candidates := make([]Path, 0, len(paths))
+		for _, path := range paths {
+			candidates = append(candidates, path)
+		}
+		for _, path := range candidates {
+			project(path)
+		}
+	}
 	activate := func(id int) {
 		if fired[id] {
 			return
@@ -48,6 +96,9 @@ func closeSecretDependencies(paths map[string]Path, sensitive map[string]bool, d
 	for head := 0; head < len(queue); head++ {
 		pointer := queue[head]
 		if classified, ok := paths[pointer]; ok && classified.valid() {
+			// Register a synthesized coordinate before visiting triggers, never
+			// while a trigger-index traversal is in progress.
+			project(classified)
 			triggers.visitAncestors(classified.String(), func(id int) {
 				if triggerValues[id].ordinary {
 					activate(id)