🔑 Add flag for using local secrets during workflow execution

[dsyme]

Summary

• Added --use-local-secrets flag to gh aw run and gh aw trial commands
• Enables pushing local environment API keys to repository during workflow execution
• Automatically cleans up secrets after workflow completes

Key Changes

• Introduced new command-line flag --use-local-secrets
• Updated CLI commands to support secret pushing and cleanup
• Modified workflow execution logic to handle temporary secret management
• Added documentation for the new secret pushing feature

How It Works

• Reads API keys from local environment variables
• Temporarily pushes required secrets to repository
• Automatically deletes secrets after workflow execution
• Supports multiple AI engine secrets (Anthropic, OpenAI, Copilot)

Security Considerations

• Secrets are only pushed temporarily
• Provides a convenient way to test workflows with local API keys
• Recommended for development and testing environments

[Copilot]

Pull Request Overview

This pull request adds a --use-local-secrets flag to both run and trial commands, enabling users to temporarily push API key secrets from their local environment to repositories for workflow execution. The feature automatically cleans up these secrets after completion.

• Added --use-local-secrets flag support to run and trial commands
• Refactored determineAndAddEngineSecret to accept EngineConfig instead of full WorkflowData
• Introduced conditional secret tracking and cleanup based on the new flag

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/cli/trial_command.go	Added --use-local-secrets flag, --repo alias, conditional secret handling, and refactored engine secret determination
pkg/cli/run_command.go	Implemented secret pushing/cleanup logic for run command with engine detection
pkg/cli/commands_test.go	Updated test calls to include new pushSecrets parameter
docs/src/content/docs/tools/cli.md	Added documentation for --use-local-secrets flag and updated examples
cmd/gh-aw/main.go	Added --use-local-secrets flag to run command

Comments suppressed due to low confidence (1)

pkg/cli/trial_command.go:955

• Debug log statement left in production code. This should be removed or placed behind a verbose/debug flag.

	fmt.Fprintln(os.Stderr, console.FormatInfoMessage(fmt.Sprintf("DEBUG: engineOverride parameter = '%s'", engineOverride)))

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.