Function GenerateMultiSecretValidationStep

pkg/workflow/engine_helpers.go:179–217

GenerateMultiSecretValidationStep creates a GitHub Actions step that validates at least one of multiple secrets is available. secretNames: slice of secret names to validate (e.g., []string{"CODEX_API_KEY", "OPENAI_API_KEY"}) engineName: the display name of the engine (e.g., "Codex") docsURL: URL to

(secretNames []string, engineName, docsURL string, envOverrides map[string]string)

// the overridden expression is used instead of the default "${{ secrets.KEY }}" so the
// validation step checks the user-provided secret reference rather than the default one.
func GenerateMultiSecretValidationStep(secretNames []string, engineName, docsURL string, envOverrides map[string]string) GitHubActionStep {
	if len(secretNames) == 0 {
		// This is a programming error - engine configurations should always provide secrets
		// Log the error and return empty step to avoid breaking compilation
		engineHelpersLog.Printf("ERROR: GenerateMultiSecretValidationStep called with empty secretNames for engine %s", engineName)
		return GitHubActionStep{}
	}

	// Build the step name
	stepName := fmt.Sprintf("      - name: Validate %s secret", strings.Join(secretNames, " or "))

	// Build the command to call the validation script
	// The script expects: SECRET_NAME1 [SECRET_NAME2 ...] ENGINE_NAME DOCS_URL
	// Use shellJoinArgs to properly escape multi-word engine names and special characters
	scriptArgs := append(secretNames, engineName, docsURL)
	scriptArgsStr := shellJoinArgs(scriptArgs)

	stepLines := []string{
		stepName,
		"        id: validate-secret",
		"        run: bash \"${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh\" " + scriptArgsStr,
		"        env:",
	}

	// Add env section with all secrets. When engine.env provides an override for a key,
	// use that expression (e.g. "${{ secrets.MY_ORG_TOKEN }}") so the validation step
	// validates the user-supplied secret instead of the default one.
	for _, secretName := range secretNames {
		expr := fmt.Sprintf("${{ secrets.%s }}", secretName)
		if envOverrides != nil {
			if override, ok := envOverrides[secretName]; ok {
				expr = override
			}
		}
		stepLines = appendEnvVarLine(stepLines, secretName, expr)
	}

	return GitHubActionStep(stepLines)
}

// BuildDefaultSecretValidationStep returns a secret validation step for the given engine
// configuration, or an empty step when a custom command is specified. This consolidates