(#15) Report multiple cue errors

This patch prints out the cue file and line numbers when a cue error
contains multiple go errors to unwrap.

For example:

```
❯ holos render --cluster-name=k2 ~/workspace/holos-run/holos/docs/examples/platforms/reference/clusters/workload/...
3:31PM ERR could not execute version=0.46.0 err="could not decode: content: error in call to encoding/yaml.MarshalStream: incomplete value string (and 1 more errors)" loc=builder.go:212
content: error in call to encoding/yaml.MarshalStream: incomplete value string:
    /home/jeff/workspace/holos-run/holos/docs/examples/schema.cue:199:11
    /home/jeff/workspace/holos-run/holos/docs/examples/cue.mod/gen/external-secrets.io/externalsecret/v1beta1/types_gen.cue:83:14
```

.run/render platform.run.xml

@@ -0,0 +1,16 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="render platform" type="GoApplicationRunConfiguration" factoryName="Go Application">
+    <module name="holos" />
+    <working_directory value="$PROJECT_DIR$/../holos-infra" />
+    <parameters value="render --cluster-name=k2 $PROJECT_DIR$/docs/examples/platforms/reference/clusters/workload/..." />
+    <envs>
+      <env name="DEBUG" value="1" />
+    </envs>
+    <kind value="DIRECTORY" />
+    <package value="github.com/holos-run/holos" />
+    <directory value="$PROJECT_DIR$/cmd/holos" />
+    <filePath value="$PROJECT_DIR$" />
+    <output_directory value="$PROJECT_DIR$/bin" />
+    <method v="2" />
+  </configuration>
+</component>

cmd/holos/testdata/issue15_cue_errors.txt

@@ -0,0 +1,15 @@
+# Want cue errors to show files and lines
+! exec holos build .
+stderr 'could not decode: content: cannot convert non-concrete value string'
+stderr '/component.cue:6:1$'
+
+-- cue.mod --
+package holos
+-- component.cue --
+package holos
+
+apiVersion: "holos.run/v1alpha1"
+kind: "KubernetesObjects"
+cluster: string @tag(cluster, string)
+content: foo
+foo: string

docs/examples/cue.mod/gen/external-secrets.io/secretstore/v1beta1/types_gen.cue

@@ -922,7 +922,7 @@ import (
 		kubernetes?: {
 			// Auth configures how secret-manager authenticates with a
 			// Kubernetes instance.
-			auth: struct.MaxFields(1) & {
+			auth: {
 				// has both clientCert and clientKey as secretKeySelector
 				cert?: {
 					// A reference to a specific 'key' within a Secret resource,

docs/examples/platforms/reference/clusters/workload/projects/secrets/components/validate/component.cue

@@ -15,8 +15,7 @@ objects: [
 	#SecretStore,
 	#ExternalSecret & {
 		_name: "validate"
-		metadata: namespace: #TargetNamespace
-		spec: dataFrom: [{extract: key: "ns/" + #TargetNamespace + "/test"}]
+		spec: data: [{remoteRef: key: _name}]
 	},
 ]
 

docs/examples/schema.cue

@@ -90,7 +90,7 @@ _apiVersion: "holos.run/v1alpha1"
 #ExternalSecret: #NamespaceObject & es.#ExternalSecret & {
 	_name: string
 	metadata: {
-		namespace: string
+		namespace: #TargetNamespace
 		name:      _name
 	}
 	spec: {
@@ -108,18 +108,19 @@ _apiVersion: "holos.run/v1alpha1"
 #SecretStore: #NamespaceObject & ss.#SecretStore & {
 	metadata: {
 		name:      string | *"default"
-		namespace: string | *#TargetNamespace
+		namespace: #TargetNamespace
 	}
 	spec: provider: {
-		vault: {
-			auth: kubernetes: {
-				mountPath: #InputKeys.cluster
-				role:      string | *"default"
-				serviceAccountRef: name: string | *"default"
+		kubernetes: {
+			remoteNamespace: #TargetNamespace
+			auth: token: bearerToken: {
+				name: string | *"eso-reader"
+				key: string | *"token"
+			}
+			server: {
+				caBundle: #InputKeys.provisionerCABundle
+				url: #InputKeys.provisionerURL
 			}
-			path:    string | *"kv/k8s"
-			server:  "https://vault.core." + #Platform.org.domain
-			version: string | *"v2"
 		}
 	}
 }
@@ -140,6 +141,11 @@ _apiVersion: "holos.run/v1alpha1"
 	// GCP Project Info used for the Provisioner Cluster
 	gcpProjectID:     string @tag(gcpProjectID, type=string)
 	gcpProjectNumber: int    @tag(gcpProjectNumber, type=int)
+
+  // Same as cluster certificate-authority-data field in ~/.holos/kubeconfig.provisioner
+	provisionerCABundle: string @tag(provisionerCABundle, type=string)
+  // Same as the cluster server field in ~/.holos/kubeconfig.provisioner
+	provisionerURL: string @tag(provisionerURL, type=string)
 }
 
 // #Platform defines the primary lookup table for the platform.  Lookup keys should be limited to those defined in #KeyTags.

pkg/cli/main.go

@@ -2,7 +2,8 @@ package cli
 
 import (
 	"context"
-	"errors"
+	"cuelang.org/go/cue/errors"
+	"fmt"
 	"github.com/holos-run/holos/pkg/holos"
 	"github.com/holos-run/holos/pkg/wrapper"
 	"log/slog"
@@ -24,12 +25,18 @@ func MakeMain(options ...holos.Option) func() int {
 // handleError is the top level error handler that unwraps and logs errors.
 func handleError(ctx context.Context, err error, hc *holos.Config) (exitCode int) {
 	log := hc.NewTopLevelLogger()
+	var cueErr errors.Error
 	var errAt *wrapper.ErrorAt
 	const msg = "could not execute"
-	if ok := errors.As(err, &errAt); ok {
+	if errors.As(err, &errAt) {
 		log.ErrorContext(ctx, msg, "err", errAt.Unwrap(), "loc", errAt.Source.Loc())
 	} else {
 		log.ErrorContext(ctx, msg, "err", err)
 	}
+	// cue errors are bundled up as a list and refer to multiple files / lines.
+	if errors.As(err, &cueErr) {
+		msg := errors.Details(cueErr, nil)
+		_, _ = fmt.Fprint(hc.Stderr(), msg)
+	}
 	return 1
 }

pkg/version/embedded/patch

@@ -1 +1 @@
-0
+1