feat(scaffolder): implementing secrets schema for scaffolder templates (#32320)

* feat: implementing secrets schema for scaffolder templates

Signed-off-by: benjdlambert <ben@blam.sh>

* chore: fix and regenerate openapi
Signed-off-by: benjdlambert <ben@blam.sh>

Signed-off-by: benjdlambert <ben@blam.sh>

* chore: fix review feedback

Signed-off-by: benjdlambert <ben@blam.sh>

* fix: address code review feedback for secrets validation

- Extract validateSecrets helper to deduplicate validation logic
- Add auditorEvent.fail() call on secrets validation failure
- Sanitize instance field in error responses to prevent secret leakage
- Add retry endpoint test coverage for secrets validation
- Split changeset into per-package entries

Signed-off-by: benjdlambert <ben@blam.sh>

* refactor: nest secrets schema under secrets.schema

Move the JSON Schema definition from spec.secrets to
spec.secrets.schema to leave room for future extensions
like secret sources.

Signed-off-by: benjdlambert <ben@blam.sh>

* chore: update API reports

Signed-off-by: benjdlambert <ben@blam.sh>

* chore: use InputError for secrets validation audit event

Signed-off-by: benjdlambert <ben@blam.sh>

---------

Signed-off-by: benjdlambert <ben@blam.sh>

plugins/scaffolder-common/report.api.md

@@ -418,6 +418,9 @@ export interface TemplateEntityV1beta3 extends Entity {
       input?: JsonObject;
     }[];
     parameters?: TemplateParametersV1beta3 | TemplateParametersV1beta3[];
+    secrets?: {
+      schema?: JsonObject;
+    };
     steps: Array<TemplateEntityStepV1beta3>;
     output?: {
       [name: string]: string;

plugins/scaffolder-common/src/Template.v1beta3.schema.json

@@ -146,6 +146,16 @@
                 }
               ]
             },
+            "secrets": {
+              "type": "object",
+              "description": "Configuration for secrets that are passed during task creation.",
+              "properties": {
+                "schema": {
+                  "type": "object",
+                  "description": "A JSONSchema for validating secrets passed during task creation."
+                }
+              }
+            },
             "presentation": {
               "type": "object",
               "description": "A way to redefine the presentation of the scaffolder.",

plugins/scaffolder-common/src/TemplateEntityV1beta3.ts

@@ -67,6 +67,13 @@ export interface TemplateEntityV1beta3 extends Entity {
      * variables passed from the user into each action in the template.
      */
     parameters?: TemplateParametersV1beta3 | TemplateParametersV1beta3[];
+    /**
+     * Configuration for secrets that are passed during task creation.
+     * The schema field contains a JSONSchema used to validate secrets.
+     */
+    secrets?: {
+      schema?: JsonObject;
+    };
     /**
      * A list of steps to be executed in sequence which are defined by the template. These steps are a list of the underlying
      * javascript action and some optional input parameters that may or may not have been collected from the end user.