Merge commit from fork

.changeset/fix-scaffolder-dryrun-secrets.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Fixed a security vulnerability where server-configured environment secrets were exposed through the scaffolder dry-run endpoint.

plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts

@@ -2053,6 +2053,42 @@ describe('NunjucksWorkflowRunner', () => {
       expect(fakeActionHandler.mock.calls[0][0].step.id).toEqual('test');
       expect(fakeActionHandler.mock.calls[0][0].step.name).toEqual('name');
     });
+
+    it('should not pass environment secrets or task secrets to action inputs during dry-run', async () => {
+      const dryRunHandler = jest.fn();
+      actionRegistry.register(
+        createTemplateAction({
+          id: 'jest-dryrun-action',
+          description: 'Mock action with dry-run support',
+          supportsDryRun: true,
+          handler: dryRunHandler,
+        }),
+      );
+
+      const task = createMockTaskWithSpec(
+        {
+          steps: [
+            {
+              id: 'test',
+              name: 'name',
+              action: 'jest-dryrun-action',
+              input: {
+                envSecret: '${{ environment.secrets.AWS_ACCESS_KEY }}',
+                taskSecret: '${{ secrets.mySecret }}',
+              },
+            },
+          ],
+        },
+        { mySecret: 'task-secret-value', backstageToken: token },
+        true,
+      );
+
+      await runner.execute(task);
+
+      const handlerCall = dryRunHandler.mock.calls[0][0];
+      expect(handlerCall.input.envSecret).toBeUndefined();
+      expect(handlerCall.input.taskSecret).toBeUndefined();
+    });
   });
 
   describe('permissions', () => {

plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts

@@ -392,9 +392,9 @@ export class NunjucksWorkflowRunner implements WorkflowRunner {
         ...context,
         environment: {
           parameters: this.environment?.parameters ?? {},
-          secrets: this.environment?.secrets ?? {},
+          secrets: task.isDryRun ? {} : this.environment?.secrets ?? {},
         },
-        secrets: task.secrets ?? {},
+        secrets: task.isDryRun ? {} : task.secrets ?? {},
       };
 
       const resolvedEach =