feat(plugin): add cockroach sql support

[syndbg]

Overview

This PR adds a new shell plugin for CockroachDB that enables secure credential management for the cockroach sql command. The plugin supports both local development (insecure mode) and production environments (secure TLS connections) through environment variable configuration.

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

Related Issue(s)

• Resolves: #
• Relates: #

How To Test

tl;dr There's a demo. https://streamable.com/btqzp5. It goes from a clean DB credential creation, renaming fields to match the expected format, etc.

Apologies for the streamable link, but GitHub has a 10mb file size limit and the mp4 demo video was already 58 or so mb.

1. Set up database credentials in 1Password with the following fields:

   • Host: localhost
   • Port: 26257
   • User: root
   • Database: defaultdb
   • insecure: 1 (for local development)

2. Test with local CockroachDB instance:

   # Start CockroachDB in insecure mode
   cockroach start-single-node --insecure --listen-addr=localhost:26257
   
   # Test the plugin
   op run -- cockroach sql

3. Test environment variable import:

   export COCKROACH_HOST=localhost
   export COCKROACH_PORT=26257
   export COCKROACH_USER=root
   export COCKROACH_INSECURE=1
   op plugin init cockroachdb

4. Run plugin validation:

   go run cmd/contrib/main.go cockroachdb/validate

Changelog

The CockroachDB plugin enables authentication for the cockroach sql command using Touch ID and other unlock options with 1Password Shell Plugins.

[github-actions]

⚠️ This PR contains unsigned commits. To get your PR merged, please sign those commits (git rebase --exec 'git commit -S --amend --no-edit -n' @{upstream}) and force push them to this branch (git push --force-with-lease).

If you're new to commit signing, there are different ways to set it up:

Sign commits with gpg

Follow the steps below to set up commit signing with gpg:

1. Generate a GPG key
2. Add the GPG key to your GitHub account
3. Configure git to use your GPG key for commit signing

Sign commits with ssh-agent

Follow the steps below to set up commit signing with ssh-agent:

1. Generate an SSH key and add it to ssh-agent
2. Add the SSH key to your GitHub account
3. Configure git to use your SSH key for commit signing

Sign commits with 1Password

You can also sign commits using 1Password, which lets you sign commits with biometrics without the signing key leaving the local 1Password process.

Learn how to use 1Password to sign your commits.

[Marton6]

Looks good! Thank you for your contribution

[syndbg]

Neat-o. Perhaps 1 more reviewer. 👁️

@mrjones2014 if you have the time

[syndbg]

Semi-yearly vibe check for 1 more review to get this merged. Perhaps @bertrmz @RyanPrussin

[syndbg]

@rr3khan I saw that the field name insecure was updated to Insecure. Fixed in 51aadf7 .

Also rebased from origin/main, since I missed a few years of commits. :)

[rr3khan]

Suggested change

	"COCKROACH_PASSWORD": fieldname.Password,
	"PGPASSWORD": fieldname.Password,

I tested a real CockroachDB v26.3.1 cluster with COCKROACH_PASSWORD set, cockroach sql still drops to an interactive Enter password: prompt instead of connecting. cockroach's SQL client is libpq-compatible and reads the standard PGPASSWORD env var and I was able to confirm that it worked with this locally.

[rr3khan]

@rr3khan I saw that the field name insecure was updated to Insecure. Fixed in 51aadf7 .

Also rebased from origin/main, since I missed a few years of commits. :)

@syndbg Thanks so much for fixing that so quickly, I have left some comments with some of my other findings, if you address them I would be more than happy to approve and merge.

[syndbg]

Cheers. Will re-check over the next few days and get it again in shape.

[syndbg]

Okay, had more time than I expected. It's working and verified now.
I took some creative liberty in a5ef840 to actually test it with a real docker container. I think this opens up a nice pattern for existing database plugins to also add their own tests with real containers.

And a user test. I re-checked with the same cockroachdb I had previously tested with cockroachdb:v25.2.4.

This is what I put in my OP Vault

Full gif showcasing the user flow.

From an op init, to actually using the cockroach sql. I explicitly unset the env vars that might influence the result to make sure we're all relying on the shell plugin.

@rr3khan ready for re-review. 🍻