Freddydk/avoidallsecrets

[freddydk]

Avoid transfering all secrets available to the repository to ReadSecrets.

Instead Determine the secrets needed and read/transfer them.

Also refactor ReadSecrets to only attempt to read the missing secrets from Azure KeyVault as secrets from GitHub has already been resolved.

TODO

• Refactor ReadSecrets to only get missing secrets from Azure DevOps
• Check for max. number of secrets (32)

[Copilot]

Pull Request Overview

This PR refactors how secrets are retrieved by introducing a step to determine exactly which secrets are needed and only reading missing ones from Azure KeyVault. It also updates existing workflows to wire the new DetermineSecrets action into ReadSecrets, removes redundant asterisk-based encryption markers in secrets lists, and refactors ReadSecrets and DetermineSecrets scripts for the new flow.

• Add DetermineSecrets action calls before ReadSecrets in all workflows
• Change ReadSecrets invocation to use a dynamic format string and indexed secret outputs (S0–S31)
• Remove * encryption markers from secrets: lists and update PowerShell scripts to fetch missing secrets from KeyVault

Reviewed Changes

Copilot reviewed 43 out of 43 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Templates/AppSource App/.github/workflows/PublishToAppSource.yaml	Inserted DetermineSecrets step and updated ReadSecrets binding to use format(…,toJSON(secrets[env.S0]),…)
Templates/AppSource App/.github/workflows/NextMinor.yaml	Removed * prefixes in secrets: list and added DetermineSecrets invocation
Actions/RunPipeline/RunPipeline.ps1	Fixed SecureString conversion flags and removed asterisk markers from pipeline secrets list
Actions/DetermineSecrets/DetermineSecrets.ps1	New script to collect requested secrets, map them, and emit FORMATSTR/S0–S31 outputs
Actions/ReadSecrets/ReadSecrets.ps1	Refactored to loop over indexed secrets, fetch missing ones from KeyVault, and mask them
Actions/ReadSecrets/ReadSecretsHelper.psm1	Simplified helper by removing old GetSecret/GetGithubSecret logic and adjusting KeyVault credential parsing

Comments suppressed due to low confidence (2)

Templates/AppSource App/.github/workflows/PublishToAppSource.yaml:79

• The DetermineSecrets action declares its output as FORMATSTR but this workflow references formatStr, which may not match and could result in empty or broken secrets input. Ensure output casing and key name match exactly.

gitHubSecrets: ${{ format(steps.DetermineSecrets.outputs.formatStr,toJSON(secrets[env.S0]),… ) }}

Templates/AppSource App/.github/workflows/NextMinor.yaml:109

• The asterisks (*) marking codeSignCertificatePassword and keyVaultCertificatePassword as encrypted were removed, which may disable encryption for these sensitive values. Confirm whether this change is intentional.

secrets: 'licenseFileUrl,codeSignCertificateUrl,codeSignCertificatePassword,...'

[mazhelez]

Don't forget release notes.