Merge branch 'store-yaml-secret-helpers' into store-yaml-helpers-core

esphome/yaml_util.py

@@ -450,9 +450,9 @@ def _load_include_candidates(
         )
 
 
-# `!secret key`, quoted or not. A text scan, not a YAML parse, so it can also match
-# comments; that errs toward including more secrets.
-_SECRET_REFERENCE_RE = re.compile(r"""!secret\s+['"]?([^\s'"]+)""")
+# `!secret key`, quoted or not, also inside flow collections. A text scan, not a
+# YAML parse, so it can also match comments; that errs toward more secrets.
+_SECRET_REFERENCE_RE = re.compile(r"""!secret\s+['"]?([^\s'",\]}]+)""")
 
 
 def find_secret_references(text: str) -> set[str]:

tests/unit_tests/test_yaml_util.py

@@ -2239,3 +2239,9 @@ def test_load_yaml_fast_mode_records_dropped_merge_keys(
 
     yaml_util.load_yaml(yaml_file, track_document_range=False)
     assert yaml_util.take_dropped_merge_keys() == [("port", str(yaml_file))]
+
+
+def test_find_secret_references_in_flow_collections() -> None:
+    """Flow mapping and sequence punctuation is not part of the secret name."""
+    text = "a: {password: !secret wifi_pw}\nb: [!secret one, !secret 'two']\n"
+    assert yaml_util.find_secret_references(text) == {"wifi_pw", "one", "two"}