Add -user-secret and -workspace-secret flags to nextflow launch (#7040)

Author: rnaidu-seqera

docs/reference/cli.md

@@ -832,12 +832,24 @@ The `launch` command launches a pipeline run in Seqera Platform. To log in and c
 `-stub-run, -stub`
 : Whether to replace scripts with command stubs when executing the run.
 
+`-user-secret`
+: :::{versionadded} 26.04.0
+  :::
+: Name of user secret to use in the pipeline.
+: Can be specified multiple times.
+
 `-w, -work-dir`
 : The directory where intermediate result files are stored.
 
 `-workspace`
 : The Seqera Platform workspace name.
 
+`-workspace-secret`
+: :::{versionadded} 26.04.0
+  :::
+: Name of workspace secret to use in the pipeline.
+: Can be specified multiple times.
+
 **Examples**
 
 Execute a pipeline in Seqera Platform.

modules/nextflow/src/main/groovy/nextflow/cli/CmdLaunch.groovy

@@ -86,6 +86,12 @@ class CmdLaunch extends CmdBase implements UsageAware {
     @Parameter(names = ['-main-script'], description = 'The script file to be executed when launching a project directory or repository')
     String mainScript
 
+    @Parameter(names = ['-user-secret'], description = 'Specify a user secret name to use in the pipeline (can be specified multiple times)')
+    List<String> userSecrets = []
+
+    @Parameter(names = ['-workspace-secret'], description = 'Specify a workspace secret name to use in the pipeline (can be specified multiple times)')
+    List<String> workspaceSecrets = []
+
     /**
      * Defines the parameters to be passed to the pipeline script
      */
@@ -124,7 +130,9 @@ class CmdLaunch extends CmdBase implements UsageAware {
             stubRun: stubRun,
             mainScript: mainScript,
             params: params,
-            launcher: launcher
+            launcher: launcher,
+            userSecrets: userSecrets,
+            workspaceSecrets: workspaceSecrets
         )
 
         // Execute launch
@@ -156,6 +164,8 @@ class CmdLaunch extends CmdBase implements UsageAware {
         result << '  -latest                   Pull latest changes before run'
         result << '  -stub-run, -stub          Execute the workflow replacing process scripts with command stubs'
         result << '  -main-script <file>       The script file to be executed when launching a project'
+        result << '  -user-secret <name>       User secret name to use in the pipeline (can be specified multiple times)'
+        result << '  -workspace-secret <name>  Workspace secret name to use in the pipeline (can be specified multiple times)'
         result << '  --<param>=<value>         Set a parameter used by the pipeline'
         result << ''
         println result.join('\n').toString()
@@ -191,5 +201,7 @@ class CmdLaunch extends CmdBase implements UsageAware {
         String mainScript
         Map<String, String> params
         Launcher launcher
+        List<String> userSecrets
+        List<String> workspaceSecrets
     }
 }

plugins/nf-tower/src/main/io/seqera/tower/plugin/launch/LaunchCommandImpl.groovy

@@ -230,6 +230,8 @@ class LaunchCommandImpl extends BaseCommandImpl implements CmdLaunch.LaunchComma
         if (paramsText) launch.paramsText = paramsText
         if (options.mainScript) launch.mainScript = options.mainScript
         if (options.entryName) launch.entryName = options.entryName
+        if (options.userSecrets) launch.userSecrets = options.userSecrets as Set
+        if (options.workspaceSecrets) launch.workspaceSecrets = options.workspaceSecrets as Set
 
         log.debug "Built launch request with ${launch.size()} parameters"
         return [launch: launch]

plugins/nf-tower/src/test/io/seqera/tower/plugin/launch/LaunchCommandImplTest.groovy

@@ -626,6 +626,44 @@ class LaunchCommandImplTest extends Specification {
         request.launch.configText == 'process.cpus = 8'
     }
 
+    def 'should include workspace and user secrets in launch request'() {
+        given:
+        def cmd = new LaunchCommandImpl()
+        def options = new CmdLaunch.LaunchOptions(
+            pipeline: 'nf-core/rnaseq',
+            userSecrets: ['MY_USER_SECRET'],
+            workspaceSecrets: ['DRAGEN_USERNAME', 'DRAGEN_PASSWORD']
+        )
+        def context = new LaunchCommandImpl.LaunchContext(
+            computeEnvId: 'ce-123',
+            workDir: 's3://bucket/work'
+        )
+
+        when:
+        def request = cmd.buildLaunchRequestPayload(options, context, 'https://github.com/nf-core/rnaseq', null, null)
+
+        then:
+        request.launch.userSecrets == ['MY_USER_SECRET'] as Set
+        request.launch.workspaceSecrets == ['DRAGEN_USERNAME', 'DRAGEN_PASSWORD'] as Set
+    }
+
+    def 'should not include secrets in launch request when none provided'() {
+        given:
+        def cmd = new LaunchCommandImpl()
+        def options = new CmdLaunch.LaunchOptions(pipeline: 'nf-core/rnaseq')
+        def context = new LaunchCommandImpl.LaunchContext(
+            computeEnvId: 'ce-123',
+            workDir: 's3://bucket/work'
+        )
+
+        when:
+        def request = cmd.buildLaunchRequestPayload(options, context, 'https://github.com/nf-core/rnaseq', null, null)
+
+        then:
+        !request.launch.containsKey('userSecrets')
+        !request.launch.containsKey('workspaceSecrets')
+    }
+
     // ===== Workflow Status Tests =====
 
     def 'should get color for workflow status'() {