@Override
        public String lookup(String key) {
            return context.getSecretSources().stream()
                    .map(source -> unchecked(() -> source.reveal(key)).apply())
                    .flatMap(o -> o.map(Stream::of).orElseGet(Stream::empty))
                    .findFirst()
                    .orElse(null);
        }
Resolve string with potential secrets

@param toInterpolate potential variables that need to revealed
@return original string with any secrets that could be resolved if secrets could not be
resolved they will be defaulted to default value defined by ':-', otherwise default to empty
String. Secrets are defined as anything enclosed by '${}'
plugin/src/main/java/io/jenkins/plugins/casc/SecretSourceResolver.java