GetRequiredSecretNames returns the list of secrets required by the Copilot engine. This includes COPILOT_GITHUB_TOKEN and optionally MCP_GATEWAY_API_KEY. It also includes COPILOT_PROVIDER_* env var keys that may carry secrets when BYOK mode is configured — allowing them to pass through strict-mode v
(workflowData *WorkflowData)
| 73 | // It also includes COPILOT_PROVIDER_* env var keys that may carry secrets when BYOK mode |
| 74 | // is configured — allowing them to pass through strict-mode validation and the secret filter. |
| 75 | func (e *CopilotEngine) GetRequiredSecretNames(workflowData *WorkflowData) []string { |
| 76 | copilotLog.Print("Collecting required secrets for Copilot engine") |
| 77 | provider := e.ResolveLLMProvider(workflowData) |
| 78 | secrets := append([]string{}, llmProviderSecretNames(provider)...) |
| 79 | // Always include the BYOK provider keys so that secrets assigned to them via engine.env |
| 80 | // pass through the strict-mode validator and FilterEnvForSecrets. |
| 81 | secrets = append(secrets, |
| 82 | constants.CopilotProviderBaseURL, |
| 83 | constants.CopilotProviderAPIKey, |
| 84 | constants.CopilotProviderBearerToken, |
| 85 | ) |
| 86 | |
| 87 | // Add MCP gateway API key if MCP servers are present (gateway is always started with MCP servers) |
| 88 | if HasMCPServers(workflowData) { |
| 89 | copilotLog.Print("Adding MCP_GATEWAY_API_KEY secret") |
| 90 | secrets = append(secrets, "MCP_GATEWAY_API_KEY") |
| 91 | } |
| 92 | |
| 93 | // Add GitHub token for GitHub MCP server if present |
| 94 | if hasGitHubTool(workflowData.ParsedTools) { |
| 95 | copilotLog.Print("Adding GITHUB_MCP_SERVER_TOKEN secret") |
| 96 | secrets = append(secrets, "GITHUB_MCP_SERVER_TOKEN") |
| 97 | } |
| 98 | |
| 99 | // Add HTTP MCP header secret names |
| 100 | headerSecrets := collectHTTPMCPHeaderSecrets(workflowData.Tools) |
| 101 | for varName := range headerSecrets { |
| 102 | secrets = append(secrets, varName) |
| 103 | } |
| 104 | if len(headerSecrets) > 0 { |
| 105 | copilotLog.Printf("Added %d HTTP MCP header secrets", len(headerSecrets)) |
| 106 | } |
| 107 | |
| 108 | // Add mcp-scripts secret names |
| 109 | if IsMCPScriptsEnabled(workflowData.MCPScripts) { |
| 110 | mcpScriptsSecrets := collectMCPScriptsSecrets(workflowData.MCPScripts) |
| 111 | for varName := range mcpScriptsSecrets { |
| 112 | secrets = append(secrets, varName) |
| 113 | } |
| 114 | if len(mcpScriptsSecrets) > 0 { |
| 115 | copilotLog.Printf("Added %d mcp-scripts secrets", len(mcpScriptsSecrets)) |
| 116 | } |
| 117 | } |
| 118 | |
| 119 | copilotLog.Printf("Total required secrets: %d", len(secrets)) |
| 120 | return secrets |
| 121 | } |
| 122 | |
| 123 | // GetSupportedEnvVarKeys returns the engine.env variable names that the Copilot engine |
| 124 | // supports as defined in the AWF specification. These cover the primary auth token and |