Function TestCodexEngineHasSecretValidation

pkg/workflow/secret_validation_test.go:200–230

(t *testing.T)

}

func TestCodexEngineHasSecretValidation(t *testing.T) {
	engine := NewCodexEngine()
	workflowData := &WorkflowData{}

	// Secret validation is now returned by GetSecretValidationStep (not GetInstallationSteps)
	step := engine.GetSecretValidationStep(workflowData)
	if len(step) == 0 {
		t.Fatal("Expected a non-empty secret validation step")
	}

	stepContent := strings.Join(step, "\n")
	if !strings.Contains(stepContent, "Validate CODEX_API_KEY or OPENAI_API_KEY secret") {
		t.Error("Secret validation step should validate CODEX_API_KEY or OPENAI_API_KEY secret")
	}

	// Should check for both secrets
	if !strings.Contains(stepContent, "CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}") {
		t.Error("Secret validation step should reference secrets.CODEX_API_KEY")
	}
	if !strings.Contains(stepContent, "OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}") {
		t.Error("Secret validation step should reference secrets.OPENAI_API_KEY")
	}

	// Should call the validate_multi_secret.sh script with both secret names
	if !strings.Contains(stepContent, "${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh") {
		t.Error("Should call validate_multi_secret.sh script")
	}
	if !strings.Contains(stepContent, "CODEX_API_KEY OPENAI_API_KEY") {
		t.Error("Should pass both CODEX_API_KEY and OPENAI_API_KEY to the script")
	}
}

func TestGenerateMultiSecretValidationStepWithEnvOverrides(t *testing.T) {
	t.Run("override replaces default secret expression", func(t *testing.T) {