cue/load: passing a map of tags to dependencies

[myitcv]

Asked by Milos Ostojic on Slack:

When running load.Instances, is there a way to pass map of tags to packages imported by main package?

[myitcv]

Noting my reply from Slack to bring the thread up-to-date.

This is a very interesting question given some recent work we have been doing in this space.

Please can you provide a bit more detail on what it is you're trying to do here?

[mostoja]

I have a package that uses several tags that imports package that can be used on its own and uses tags to. So what I was trying to do is to find a way pass tags to inner package directly when building instance of outer package. As I mentioned on Slack, I've ended up refactoring inner package so that values are passed from outer and it works now.

Let's say there's package called outer that has tag testTag and imports package inner:

package outer

import "github.com/someone/test/inner"

#testTag: *"whatever" | string @tag(testTag)

something: "\(inner.innerTag)-\(#testTag)"

and package inner

package inner

innerTag: *"something else" | string @tag(innerTag)

So if I run cue eval -c -t testTag="not whatever", I'll end up with
something: "something else-not whatever

But there's no way of passing innerTag through cli and I can't find a way to pass it to load.Instaces either

[rogpeppe]

Thanks for the information! As you've found out, the only reasonable way to do this currently is to define all the tags in a top level package and pass them down, but the rules might become more general in future, as mentioned elsewhere in this discussion.

[rogpeppe]

The question of whether to apply tags to imports is one that we've been discussing quite a bit, with recent changes to recognise @if attributes across modules.

The tricky issue here is that tags live in a global namespace, so if we apply them to all imported packages, there's no guarantee that someone in an imported module isn't using a tag name quite differently. It also could lead to potential security issues, allowing external dependencies to "harvest" tag values that they really shouldn't have access to.

The current behavior is the same as it's been for a while now (at least since v0.4.3): tags are injected only into packages that are explicitly mentioned on the command line.

A couple of other possibilities:

• inject tags into all packages in the main module
• provide a way to specify an explicit set of packages to which to apply injection

[mostoja]

It would be a great feature but I completely understand challenges. I would personally be completely OK with risk of someone using tag differently but harvesting other packages' tags is very concerning.
I like idea of explicitly assigning tags to packages, perhaps using dot notation

Best regards