Allow decodeBase64 to work with nested variables

integrations/src/test/java/io/jenkins/plugins/casc/SSHCredentialsTest.java

@@ -118,4 +118,15 @@ public Optional<String> reveal(String secret) {
             return Optional.empty();
         }
     }
+
+    @Test
+    @ConfiguredWithCode("SSHCredentialsTest_Recursive_Key.yml")
+    @Issue("https://github.com/jenkinsci/configuration-as-code-plugin/issues/2488")
+    void shouldSupportRecursiveBase64Certificates(JenkinsConfiguredWithCodeRule j) {
+        BasicSSHUserPrivateKey certKey = getCredentials(BasicSSHUserPrivateKey.class);
+        assertThat(
+                "Private key roundtrip failed",
+                certKey.getPrivateKeys().get(0).trim().replace("\r\n", "\n"),
+                equalTo(MySSHKeySecretSource.PRIVATE_SSH_KEY));
+    }
 }

integrations/src/test/resources/io/jenkins/plugins/casc/SSHCredentialsTest_Recursive_Key.yml

@@ -0,0 +1,14 @@
+jenkins:
+  systemMessage: Jenkins with SSH Credentials for JCasC test
+
+credentials:
+  system:
+    domainCredentials:
+      - credentials:
+          - basicSSHUserPrivateKey:
+              scope: SYSTEM
+              id: "userid_recursive"
+              username: "recursive-user"
+              privateKeySource:
+                directEntry:
+                  privateKey: ${decodeBase64:${SSH_AGENT_PRIVATE_KEY_BASE64}}

plugin/src/main/java/io/jenkins/plugins/casc/SecretSourceResolver.java

@@ -201,7 +201,32 @@ static class DecodeBase64Lookup implements StringLookup {
 
         @Override
         public String lookup(@NonNull final String key) {
-            return new String(Base64.getDecoder().decode(key.getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8);
+            if (StringUtils.isBlank(key)) {
+                return "";
+            }
+
+            final String value = key.trim();
+
+            if (value.startsWith("-----BEGIN ")) {
+                return value;
+            }
+
+            String compact = value.replaceAll("\\s+", "");
+
+            try {
+                return new String(Base64.getDecoder().decode(compact), StandardCharsets.UTF_8);
+            } catch (IllegalArgumentException e) {
+                try {
+                    return new String(Base64.getUrlDecoder().decode(compact), StandardCharsets.UTF_8);
+                } catch (IllegalArgumentException e2) {
+                    LOGGER.log(
+                            Level.WARNING,
+                            "Configuration import: Failed to decode base64 secret. "
+                                    + "The value might not be resolved yet or is invalid base64. Defaulting to empty string.",
+                            e2);
+                    return "";
+                }
+            }
         }
     }