Function getSecretRequirements

pkg/cli/tokens_bootstrap.go:124–153

getSecretRequirements discovers all workflows and collects their required secrets

(engineFilter string)

// getSecretRequirements discovers all workflows and collects their required secrets
func getSecretRequirements(engineFilter string) ([]SecretRequirement, error) {
	tokensBootstrapLog.Printf("Discovering workflows (engine filter: %s)", engineFilter)

	var allRequirements []SecretRequirement

	// If engine is explicitly specified, we can bootstrap without workflows
	if engineFilter != "" {
		tokensBootstrapLog.Printf("Engine explicitly specified, bootstrapping for %s regardless of workflows", engineFilter)
		// Get engine-specific secrets and system secrets (including optional)
		allRequirements = getSecretRequirementsForEngine(engineFilter, true, true)
	} else {
		// Discover workflow files
		workflowFiles, err := getMarkdownWorkflowFiles("")
		if err != nil {
			return nil, fmt.Errorf("failed to discover workflows: %w", err)
		}

		if len(workflowFiles) == 0 {
			return nil, errors.New("no workflow files found in .github/workflows/")
		}

		tokensBootstrapLog.Printf("Found %d workflow files, extracting secrets", len(workflowFiles))

		// Use getRequiredSecretsForWorkflows to collect and deduplicate secrets
		allRequirements = getSecretsRequirementsForWorkflows(workflowFiles)
	}

	tokensBootstrapLog.Printf("Returning %d deduplicated secret requirements", len(allRequirements))
	return allRequirements, nil
}