Refactor engine secret validation wrappers

[Copilot]

Engine-specific secret validation methods repeated the same skip-then-build pattern across multiple workflow engines. This centralizes that flow while keeping engine-specific auth and skip policies intact.

• Shared validation helper

  • Added EngineSecretValidationConfig.
  • Added BuildEngineSecretValidationStep to apply skip policy, handle empty secret sets, and delegate rendering.

• Engine migrations

  • Updated Claude, Codex, Copilot, Gemini, Pi, behavior-defined, and universal LLM engines to use the shared path.
  • Preserved existing WIF, BYOK, copilot-requests: write, custom command, environment, and provider-specific behavior.

• Focused coverage

  • Added tests for shared helper behavior: skip predicate, empty secret list, and rendered validation step.

returnBuildEngineSecretValidationStep(workflowData, EngineSecretValidationConfig{
SecretNames: []string{"GEMINI_API_KEY"},
EngineName: "Gemini CLI",
DocsURL: "https://geminicli.com/docs/get-started/authentication/",
Skip: isGeminiVertexWIF,
})

• Fixes[duplicate-code] Duplicate Code: Engine secret-validation wrappers in pkg/workflow #51215

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 39.7 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.1 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Centralizes engine secret-validation setup while preserving engine-specific authentication and skip behavior.

Changes:

• Added a shared validation configuration and builder.
• Migrated seven engine validation paths.
• Added focused helper tests.

Show a summary per file

File	Description
pkg/workflow/engine_helpers.go	Adds shared validation configuration and builder.
pkg/workflow/claude_engine.go	Migrates Claude validation while preserving WIF handling.
pkg/workflow/codex_engine.go	Migrates Codex validation.
pkg/workflow/copilot_engine_installation.go	Preserves permission and BYOK skip policies.
pkg/workflow/gemini_engine.go	Preserves Vertex WIF handling.
pkg/workflow/pi_engine.go	Migrates backend-profile validation.
pkg/workflow/behavior_defined_engine.go	Migrates behavior-defined validation.
pkg/workflow/universal_llm_consumer_engine.go	Migrates universal backend validation.
pkg/workflow/secret_validation_test.go	Tests skip, empty-secret, and rendering behavior.
pkg/workflow/awf_feature_flags_test.go	Normalizes import formatting.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 10/10 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

⚠️ Security scanning failed for Test Quality Sentinel. Review the logs for details.

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

⚠️ Security scanning failed for Design Decision Gate 🏗️. Review the logs for details.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

⚠️ Security scanning failed for Matt Pocock Skills Reviewer. Review the logs for details.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

Review: Refactor engine secret validation wrappers

Clean refactoring that consolidates the duplicated guard+delegate pattern across six engine implementations into a single BuildEngineSecretValidationStep function. All skip logic and empty-secret guards are now centrally handled in engine_helpers.go.

The Skip func(*WorkflowData) bool field provides a clean, testable extension point for per-engine skip policies. Tests cover all three paths (skip policy, empty secrets, rendering). No correctness or security issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 18.9 AIC · ⊞ 5.5K

[github-actions]

🏗️ Design Decision Gate — ADR Required

This PR makes significant changes to core business logic (112 new lines in pkg/ business directories) but does not have a linked Architecture Decision Record (ADR).

📄 Draft ADR committed: docs/adr/51216-centralize-engine-secret-validation-config.md — review and complete it before merging.

🔒 This PR cannot merge until an ADR is linked in the PR body.

📋 What to do next

1. Review the draft ADR committed to your branch — it was generated from the PR diff
2. Complete the missing sections — add context the AI couldn't infer, refine the decision rationale, and list real alternatives you considered
3. Commit the finalized ADR to docs/adr/ on your branch
4. Reference the ADR in this PR body by adding a line such as:

   ADR: ADR-51216: Centralize Engine Secret Validation via a Shared Config Helper

Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision.

❓ Why ADRs Matter

"AI made me procrastinate on key design decisions. Because refactoring was cheap, I could always say 'I'll deal with this later.' Deferring decisions corroded my ability to think clearly."

ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors (and your future self) will thank you.

📋 Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

• Context — What is the problem? What forces are at play?
• Decision — What did you decide? Why?
• Alternatives Considered — What else could have been done?
• Consequences — What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number (e.g., 51216-centralize-engine-secret-validation-config.md for PR #51216).

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · sonnet46 · 54.7 AIC · ⊞ 8.8K · ◷
_{Comment /review to run again}

[github-actions]

Test Quality Sentinel Report 🧪

Overall Assessment: ✅ 82/100 Excellent

PR: Refactor engine secret validation wrappers (#51216)
Test Files Changed: 2 files | New Tests: 1 function + 3 subtests | Lines Added: 37 test lines

---

Test Summary

New Test: TestBuildEngineSecretValidationStep (37 lines)

This new test validates the refactored wrapper function that applies engine-specific skip policies before rendering secret validation steps.

Subtest Classification (3/3 Design Tests)

Subtest	Type	Value	Edge Case?
"applies skip policy before rendering"	behavioral_contract	high_value	✅ skip=true
"skips empty secret list"	behavioral_contract	high_value	✅ empty secrets
"renders configured validation step"	behavioral_contract	high_value	✅ happy path

Assertions: 5 total

• require.Empty(t, step, "...") × 2 — guard clauses
• require.NotEmpty(t, step, "...") × 1 — positive case
• assert.Contains(...) × 2 — rendered output validation

All assertions include descriptive failure messages ✅

---

Quality Metrics

Metric	Result	Status
Design Tests	3/3 (100%)	✅ Excellent
Edge Case Coverage	3/3 subtests	✅ Skip policy, empty secrets, happy path
Assertions	5 with messages	✅ All descriptive
Mocking	None (real objects)	✅ Clean test design
Test:Prod Ratio	37:67 ≈ 0.55:1	✅ Well under 2:1 threshold
Duplicate Patterns	0 clusters	✅ No inflation
Build Tags	Present on both files	✅ (go/redacted):build !integration

---

Scoring Breakdown

Design tests (3/3): 40 points ✅
Edge cases (3/3): 30 points ✅
No duplicates: 20 points ✅
Test inflation (0.55:1): 10 points ✅
────────────────────────────────────
Total: 82/100

Threshold: >= 80 = Excellent ✅

---

Key Strengths

1. Focused refactoring validation — Test precisely targets the new wrapper's ordering guarantee (skip policies applied before rendering)
2. Clean architecture — No mocking; tests real EngineSecretValidationConfig and WorkflowData objects
3. Guard clauses tested — Both skip policy and empty-secrets edge cases are explicitly validated
4. Healthy test:prod ratio — 0.55:1 shows appropriate test focus without over-testing boilerplate
5. 100% design tests — All assertions verify user-visible behavior, not implementation details

---

Minor Notes

• The test delegates multiple-secret scenarios to existing TestGenerateMultiSecretValidationStep tests — appropriate separation of concerns
• Import reordering in awf_feature_flags_test.go (2 lines) has no test impact; aligns with Go conventions

---

Verdict

✅ APPROVE — No violations. Implementation tests represent 0% of total (well below 30% threshold). Test design is clean, focused, and validates the refactoring's behavioral contracts.

🧪 Test quality analysis by Test Quality Sentinel · haiku45 · 27.5 AIC · ⊞ 7.7K · ◷
_{Comment /review to run again}

[github-actions]

Skills-Based Review

Applied /codebase-design — approving. The refactor cleanly centralizes the skip-then-build pattern into BuildEngineSecretValidationStep with a pluggable Skip callback. Deep-module improvement: simple interface, engine-specific policy preserved. Tests cover the three key branches (skip predicate, empty secrets, rendered step). Net -38 LOC with no behaviour change.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 31.2 AIC · ⊞ 7.1K
_{Comment /matt to run again}

[github-actions]

✅ Test Quality Sentinel: 82/100 Excellent

• Design tests: 3/3 (100%)
• Edge cases: 3/3 (skip policy, empty secrets, happy path)
• Test:prod ratio: 0.55:1 (well under 2:1 threshold)
• Implementation tests: 0% (well below 30% threshold)
• No guideline violations

The new TestBuildEngineSecretValidationStep test precisely validates the refactoring's behavioral contracts with clean, real-object testing and proper assertion messages.

[gh-aw-bot]

@copilot Quick triage nudge for this PR.

Please refresh the branch if needed, address any remaining review feedback, update the PR body with the ADR link required by the design-decision gate, and run the pr-finisher skill before handing back to maintainers.

Run: https://github.com/github/gh-aw/actions/runs/31225438989

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 39.7 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[gh-aw-bot]

@copilot Quick triage nudge for this PR.

Please refresh the branch if needed, update the PR body with the ADR link required by the design-decision gate, run the pr-finisher skill, and hand back to maintainers once the PR is ready.

Outstanding item:

• Design Decision Gate requires linking docs/adr/51216-centralize-engine-secret-validation-config.md in the PR body.

Run: https://github.com/github/gh-aw/actions/runs/31227649983

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.1 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[github-actions]

Triage

Category: refactor | Risk: medium | Score: 65/100

Component	Score
Impact	30/50
Urgency	15/30
Quality	20/20

Recommended action:fast_track (batch: refactor-eng, with #51229)

CI passing with 3 automated approvals, includes an ADR doc and centralizes engine secret validation across 12 files. Solid quality signal — ready for expedited human review.

Generated by 🔧 PR Triage Agent · auto · 39.7 AIC · ⌖ 2.79 AIC · ⊞ 8K · ◷

[pelikhan]

@copilot fix https://github.com/github/gh-aw/actions/runs/31226096312/job/93036451458#step:7:1

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.2