Description

The registered Using Secrets guided tour — a 12-step walkthrough of why credentials don't belong in a pipeline, what secrets are, and the two ways to attach one. Uses the secret interaction mechanics, the in-editor Settings stand-in, and the in-memory mock backend from #2405, and boots into a small Secrets tour pipeline that makes an authenticated HTTP request.

The tour covers the whole lifecycle: the problem → what a secret is → create one and bind it to a task argument → manage secrets in an in-editor Settings → Secrets stand-in → then the alternative: bind a secret to a pipeline input at submit time.

It runs hands-on with or without a backend: it sets mockBackend: true, so when no real backend is available the secret steps work against the in-memory mock from #2405 (ephemeral, never leaves the browser); with a backend they use the real secrets API. Either way the steps gate normally.

What's in the tour

1. The problem — everything in a pipeline is shared and visible (centered, no spotlight)
2. What a secret is — value stays on the backend, only the name travels (centered)
3. Interactive — select the Authenticated Request task (select-task)
4. Interactive — open the token argument's ⚡ menu → Dynamic Data → Select Secret (open-secret-dialog)
5. Interactive — Add Secret, then pick it to bind it to the argument (assign-secret-argument)
6. Outcome — the token argument now shows the secret by name, with a lock icon (context panel)
7. Interactive — click the Settings gear to open the secrets manager (open-settings-panel)
8. Settings → Secrets — replace a value or delete a secret here (the in-editor stand-in)
9. The second way — leave a pipeline input empty and bind at submit time (rings the API_KEY input node)
10. Interactive — open the run arguments dialog from Runs and submission (open-submit-dialog)
11. Interactive — bind a secret to API_KEY via the Use Secret lock button (assign-secret-submit)
12. Wrap-up — the API_KEY input is now backed by the secret; with a backend you can Submit Run, then finish (the copy reads correctly whether or not a real run is launched)

DOM anchors & assets added in this PR

Following the convention that tour-specific anchors ship with the tour:

• mockBackend: true on the tour definition — opts the Secrets tour into the in-memory mock backend (from feat: Guided Tours Framework (Secrets) #2405) when no real backend is available.
• Seed pipeline — public/tour-pipelines/Secrets.pipeline.component.yaml (Secrets: an Authenticated Request task taking a token and an api_key, wired to an empty API_KEY input, plus a Show Response echo task).
• ThunderMenu — data-tour="thunder-menu-content"; DynamicDataSubmenu — data-tour="thunder-menu-submenu-content" (so the ⚡ menu and its submenu can be spotlit together).
• SubmitTaskArgumentsDialog — data-tour="submit-arguments-dialog" and data-tour="submit-arguments-confirm".

Interactions consumed (defined in #2405): select-task, open-secret-dialog, assign-secret-argument, open-settings-panel, open-submit-dialog, assign-secret-submit. The using-secrets Learning Hub entry was already registered lower in the stack, so no tours.json / FeaturedTours change is needed here.

Related Issue and Pull requests

Progresses https://github.com/Shopify/oasis-frontend/issues/583

Depends on #2405 (secret interaction mechanics, in-editor Settings stand-in, and the in-memory mock backend) and the framework stack below it.

Type of Change

• New feature

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Test Instructions

Start the Using Secrets tour from the Learning Hub and walk all 12 steps.

With a backend (configured + authorized for the secrets API):

• Steps 3–5 create and bind a secret through the ⚡ menu; the token argument should end up showing the secret name, not a value.
• Step 7 opens the in-editor Settings stand-in (the gear does not navigate away); step 8 shows the real secrets list with working replace/delete.
• Steps 10–11 bind a secret to API_KEY in the submit dialog; step 12's Submit Run is enabled and Finish Tour is clickable while the dialog is open.

Without a backend (mock path):

• The same steps are fully hands-on against the in-memory mock — the picker/list show real content (not the error icon) and no /api/secrets calls fire.
• Steps gate normally (Next stays disabled until the action is done).
• In the submit dialog the secret-to-input assignment works; Submit Run is disabled (no real run to launch) and the tour wraps up via Finish Tour.

Screenshots