[mq] [skip ddci] working branch - merge 2c6bee8 on top of main at 8cb066c

gh-worker-dd-mergequeue-cf854d[bot] · web-flow · commit afce95a71560 · 2026-03-19T17:23:29.000Z
{"baseBranch":"main","baseCommit":"8cb066c2405e418572ae278d314b7d362af91b3e","createdAt":"2026-03-19T16:54:46.454831Z","headSha":"2c6bee882a0cb2e3973ed0fe030c2a3a1fdf9c87","id":"b64d5b40-3bce-4bf4-8eb7-4ae6eae4f938","nextMergeabilityCheckAt":"2026-03-19T18:23:00.219018Z","priority":"200","pullRequestNumber":"855","queuedAt":"2026-03-19T17:23:21.942461Z","status":"STATUS_QUEUED"}
diff --git a/crates/cli/src/model/datadog_api.rs b/crates/cli/src/model/datadog_api.rs
@@ -942,8 +942,9 @@ mod tests {
             Some(SecretRuleMatchValidation::CustomHttpV2(_))
         ));
         if let Some(SecretRuleMatchValidation::CustomHttpV2(config)) = rule.match_validation {
-            assert_eq!(config.provides[0].kind, "some_vendor");
-            assert_eq!(config.provides[0].name, "client_id");
+            let provides = config.provides.expect("expected paired validator config");
+            assert_eq!(provides[0].kind, "some_vendor");
+            assert_eq!(provides[0].name, "client_id");
         } else {
             panic!("Expected CustomHttpV2 variant");
         }
diff --git a/crates/secrets/src/model/secret_rule.rs b/crates/secrets/src/model/secret_rule.rs
@@ -269,19 +269,20 @@ impl TryFrom<&SecretRuleMatchValidation> for MatchValidationType {
                     .collect();
 
                 // Convert provides
-                let provides: Vec<PairedValidatorConfig> = custom_http_v2
-                    .provides
-                    .iter()
-                    .map(|p| PairedValidatorConfig {
-                        kind: p.kind.clone(),
-                        name: p.name.clone(),
-                    })
-                    .collect();
+                let provides = custom_http_v2.provides.as_ref().map(|provides| {
+                    provides
+                        .iter()
+                        .map(|p| PairedValidatorConfig {
+                            kind: p.kind.clone(),
+                            name: p.name.clone(),
+                        })
+                        .collect()
+                });
 
                 Ok(MatchValidationType::CustomHttpV2(CustomHttpConfigV2 {
                     match_pairing,
                     calls,
-                    provides: Some(provides),
+                    provides,
                 }))
             }
         }
@@ -306,7 +307,8 @@ pub struct SecretRuleMatchValidationHttpV2 {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub match_pairing: Option<SecretRuleMatchPairingConfig>,
     pub calls: Vec<SecretRuleHttpCallConfig>,
-    pub provides: Vec<SecretRulePairedValidatorConfig>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub provides: Option<Vec<SecretRulePairedValidatorConfig>>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, Eq, PartialEq)]
@@ -688,7 +690,7 @@ mod tests {
                     ],
                 },
             }],
-            provides: vec![
+            provides: Some(vec![
                 SecretRulePairedValidatorConfig {
                     kind: "datadog".to_string(),
                     name: "api_key".to_string(),
@@ -697,7 +699,7 @@ mod tests {
                     kind: "datadog".to_string(),
                     name: "app_key".to_string(),
                 },
-            ],
+            ]),
         };
 
         let validation = SecretRuleMatchValidation::CustomHttpV2(http_v2_config);
@@ -893,7 +895,7 @@ mod tests {
                     ],
                 },
             }],
-            provides: vec![
+            provides: Some(vec![
                 SecretRulePairedValidatorConfig {
                     kind: "datadog".to_string(),
                     name: "api_key".to_string(),
@@ -902,7 +904,7 @@ mod tests {
                     kind: "datadog".to_string(),
                     name: "app_key".to_string(),
                 },
-            ],
+            ]),
         });
     }
 }
