getSecretRequirementsForWorkflow extracts the engine from a workflow file and returns its required secrets. It also extracts AuthDefinition secrets from inline engine definitions. NOTE: In future we will want to analyse more parts of the workflow to work out other secrets required, or detect that t
(workflowFile string)
| 62 | // authorization being used in a workflow means certain secrets are not required. |
| 63 | // For now we are only looking at the secrets implied by the engine used. |
| 64 | func getSecretRequirementsForWorkflow(workflowFile string) []SecretRequirement { |
| 65 | workflowSecretsLog.Printf("Extracting secrets for workflow: %s", workflowFile) |
| 66 | |
| 67 | // Extract engine from workflow file |
| 68 | engine, engineConfig, frontmatter := extractEngineConfigFromFile(workflowFile) |
| 69 | if engine == "" { |
| 70 | workflowSecretsLog.Printf("No engine found in workflow %s, skipping", workflowFile) |
| 71 | return nil |
| 72 | } |
| 73 | |
| 74 | workflowSecretsLog.Printf("Workflow %s uses engine: %s", workflowFile, engine) |
| 75 | |
| 76 | // Get engine-specific secrets only (no system secrets, no optional) |
| 77 | // System secrets will be added separately to avoid duplication |
| 78 | reqs := getSecretRequirementsForEngine(engine, false, false) |
| 79 | |
| 80 | // For inline engine definitions with an AuthDefinition, also include auth secrets. |
| 81 | if engineConfig != nil && engineConfig.InlineProviderAuth != nil { |
| 82 | authReqs := secretRequirementsFromAuthDefinition(engineConfig.InlineProviderAuth, engine) |
| 83 | workflowSecretsLog.Printf("Adding %d auth definition secret(s) for workflow %s", len(authReqs), workflowFile) |
| 84 | reqs = append(reqs, authReqs...) |
| 85 | } |
| 86 | if hasCopilotRequestsWritePermission(frontmatter) { |
| 87 | if opt := constants.GetEngineOption(engine); opt != nil && opt.SecretName == "COPILOT_GITHUB_TOKEN" { |
| 88 | reqs = filterOutSecretRequirement(reqs, "COPILOT_GITHUB_TOKEN") |
| 89 | } |
| 90 | } |
| 91 | |
| 92 | return reqs |
| 93 | } |
| 94 | |
| 95 | // extractEngineConfigFromFile parses a workflow file and returns the engine ID and config. |
| 96 | // Returns ("", nil) when the file cannot be read or parsed. |