feat(task): pass scoped user secret names (#319)

Forward optional secret allowlists and step-local REANA hints
from CWL workflows so job submissions preserve workflow defaults,
step overrides, and the documented omitted-versus-empty semantics.

Closes reanahub/reana#978

Author: Michael Buchar

reana_workflow_engine_cwl/cwl_reana.py

@@ -33,6 +33,16 @@
 from reana_commons.api_client import JobControllerAPIClient as rjc_api_client
 from reana_commons.config import REANA_WORKFLOW_UMASK
 
+try:
+    from reana_commons.k8s.secrets import resolve_secret_names
+except ModuleNotFoundError:
+    def resolve_secret_names(scoped_secret_names, workflow_resources=None):
+        """Resolve a step-local allowlist against the workflow-global default."""
+        if scoped_secret_names is not None:
+            return scoped_secret_names
+        workflow_resources = workflow_resources or {}
+        return workflow_resources.get("secret_names")
+
 from reana_workflow_engine_cwl.config import LOGGING_MODULE, MOUNT_CVMFS
 from reana_workflow_engine_cwl.pipeline import Pipeline
 from reana_workflow_engine_cwl.poll import PollThread
@@ -51,6 +61,7 @@ def __init__(self, **kwargs):
         self.service = kwargs.get(
             "rjc_api_client", rjc_api_client("reana-job-controller")
         )
+        self.workflow_resources = kwargs.get("workflow_resources") or {}
         if kwargs.get("basedir") is not None:
             self.basedir = kwargs.get("basedir")
         else:
@@ -280,6 +291,9 @@ def shouldquote(x):
         c4p_cpu_cores = self._get_hint("c4p_cpu_cores")
         c4p_memory_limit = self._get_hint("c4p_memory_limit")
         c4p_additional_requirements = self._get_hint("c4p_additional_requirements")
+        secret_names = resolve_secret_names(
+            self._get_hint("secret_names"), getattr(self, "workflow_resources", {})
+        )
         create_body = {
             "image": container,
             "cmd": wrapped_cmd,
@@ -293,6 +307,7 @@ def shouldquote(x):
             "unpacked_img": unpacked_img,
             "voms_proxy": voms_proxy,
             "rucio": rucio,
+            "secret_names": secret_names,
             "htcondor_max_runtime": htcondor_max_runtime,
             "htcondor_accounting_group": htcondor_accounting_group,
             "htcondor_request_cpus": htcondor_request_cpus,
@@ -332,6 +347,7 @@ def _get_hint(self, hint_name):
     def run(self, runtimeContext):  # noqa: C901
         """Run a job."""
         self._setup(runtimeContext)
+        self.workflow_resources = runtimeContext.pipeline.workflow_resources
 
         env = self.environment
         if not os.path.exists(self.tmpdir):

reana_workflow_engine_cwl/main.py

@@ -47,6 +47,7 @@ def main(
     rjc_api_client,
     workflow_uuid,
     workflow_spec,
+    workflow_resources,
     workflow_inputs,
     operational_options,
     working_dir,
@@ -127,7 +128,9 @@ def main(
     if parsed_args.debug:
         log.setLevel(logging.DEBUG)
 
-    pipeline = ReanaPipeline(rjc_api_client=rjc_api_client)
+    pipeline = ReanaPipeline(
+        rjc_api_client=rjc_api_client, workflow_resources=workflow_resources
+    )
     log.info("starting the run..")
     db_log_writer = SQLiteHandler(workflow_uuid, publisher)
 

reana_workflow_engine_cwl/tasks.py

@@ -32,6 +32,7 @@ def run_cwl_workflow_engine_adapter(
     workflow_uuid=None,
     workflow_workspace=None,
     workflow_json=None,
+    workflow_resources=None,
     workflow_parameters=None,
     operational_options={},
     **kwargs,
@@ -43,6 +44,7 @@ def run_cwl_workflow_engine_adapter(
         rjc_api_client,
         workflow_uuid,
         workflow_json,
+        workflow_resources,
         workflow_parameters,
         operational_options,
         workflow_workspace,

tests/test_cwl_reana.py

@@ -0,0 +1,57 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of REANA.
+# Copyright (C) 2026 CERN.
+#
+# REANA is free software; you can redistribute it and/or modify it
+# under the terms of the MIT License; see LICENSE file for more details.
+
+"""REANA-Workflow-Engine-CWL tests."""
+
+from types import SimpleNamespace
+
+import pytest
+
+from reana_workflow_engine_cwl.cwl_reana import ReanaPipelineJob
+
+
+@pytest.mark.parametrize(
+    "step_secret_names,workflow_secret_names,expected_secret_names",
+    [
+        (None, None, None),
+        (None, ["global"], ["global"]),
+        ([], ["global"], []),
+        (["local"], ["global"], ["local"]),
+    ],
+)
+def test_create_task_msg_secret_names_resolution(
+    step_secret_names, workflow_secret_names, expected_secret_names
+):
+    """Step hints should override or inherit workflow-global secret_names."""
+    job = ReanaPipelineJob.__new__(ReanaPipelineJob)
+    job.name = "fit"
+    job.environment = {"HOME": "/tmp/outdir"}
+    job.volumes = []
+    job.command_line = ["echo", "hello"]
+    job.stdin = None
+    job.stdout = None
+    job.stderr = None
+    job.outdir = "/tmp/outdir"
+    job.builder = SimpleNamespace(outdir="/tmp/outdir", bindings=[])
+    job.workflow_resources = (
+        {"secret_names": workflow_secret_names}
+        if workflow_secret_names is not None
+        else {}
+    )
+    job.hints = []
+    if step_secret_names is not None:
+        job.hints.append({"secret_names": step_secret_names})
+    job.get_requirement = lambda name: (
+        ({"dockerPull": "docker.io/library/busybox"}, None)
+        if name == "DockerRequirement"
+        else (None, None)
+    )
+
+    create_body = job.create_task_msg("/tmp/workspace", "workflow-uuid")
+
+    assert create_body["secret_names"] == expected_secret_names