feat(preprocess): add deployment jobs and S3 source

harness/tht/config.py

@@ -39,17 +39,20 @@ def _expand_env(value: Any) -> Any:
 def _resolve_secret_files(value: Any) -> Any:
     if isinstance(value, dict):
         resolved = {key: _resolve_secret_files(item) for key, item in value.items()}
-        if "password_file" in resolved:
-            if "password" in resolved:
-                raise ConfigError("password and password_file are mutually exclusive")
-            path = Path(resolved.pop("password_file"))
+        for secret_name in ("password", "access_key", "secret_key", "session_token"):
+            file_name = f"{secret_name}_file"
+            if file_name not in resolved:
+                continue
+            if secret_name in resolved:
+                raise ConfigError(f"{secret_name} and {file_name} are mutually exclusive")
+            path = Path(resolved.pop(file_name))
             try:
                 secret = path.read_text()
             except (OSError, UnicodeError) as exc:
                 raise ConfigError(f"Cannot read secret file: {path}") from exc
             if not secret or any(char.isspace() for char in secret) or "\x00" in secret:
                 raise ConfigError(f"Invalid secret file: {path}")
-            resolved["password"] = secret
+            resolved[secret_name] = secret
         return resolved
     if isinstance(value, list):
         return [_resolve_secret_files(item) for item in value]
@@ -192,8 +195,25 @@ class HttpEvidenceSourceConfig(BaseModel):
     max_cache_bytes: int = Field(default=64 * 1024 * 1024, gt=0)
 
 
+class S3EvidenceSourceConfig(BaseModel):
+    type: Literal["s3"]
+    bucket: str = Field(min_length=1)
+    prefix: str = ""
+    endpoint_url: str | None = None
+    region: str | None = None
+    access_key: SecretStr | None = None
+    secret_key: SecretStr | None = None
+    session_token: SecretStr | None = None
+    allow_private_endpoint: bool = False
+    allow_insecure_endpoint: bool = False
+    max_bytes: int = Field(default=10 * 1024 * 1024, gt=0)
+    max_objects: int = Field(default=10_000, gt=0)
+    max_pages: int = Field(default=100, gt=0)
+    page_size: int = Field(default=1000, gt=0, le=1000)
+
+
 EvidenceSourceConfig = Annotated[
-    FilesystemEvidenceSourceConfig | HttpEvidenceSourceConfig,
+    FilesystemEvidenceSourceConfig | HttpEvidenceSourceConfig | S3EvidenceSourceConfig,
     Field(discriminator="type"),
 ]