Add -user-secret and -workspace-secret flags to nextflow launch

docs/migrations/26-04.md

@@ -337,6 +337,23 @@ workflow RNASEQ {
 
 See the {ref}`cli-lint` command reference for details.
 
+<h3>New <code>-user-secret</code> and <code>-workspace-secret</code>  options for <code>launch</code> command</h3>
+
+The `launch` command now has `-user-secret` and `-workspace-secret` options, which can be used to specify secrets for Seqera Platform pipeline runs.
+
+```bash
+nextflow launch myorg/pipeline \
+    -r main \
+    -profile awsbatch \
+    -workspace-secret DRAGEN_USERNAME \
+    -workspace-secret DRAGEN_PASSWORD \
+    -user-secret MY_USER_SECRET
+```
+
+Each option can be specified multiple times.
+
+See the {ref}`cli-launch` command reference for details.
+
 ## Breaking changes
 
 - The {ref}`strict syntax parser <strict-syntax-page>` is now enabled by default. The legacy parser can be enabled by setting the `NXF_SYNTAX_PARSER` environment variable to `v1`.

docs/reference/cli.md

@@ -832,9 +832,21 @@ The `launch` command launches a pipeline run in Seqera Platform. To log in and c
 `-stub-run, -stub`
 : Whether to replace scripts with command stubs when executing the run.
 
+`-user-secret`
+: :::{versionadded} 26.04.0
+  :::
+: Name of user secret to use in the pipeline.
+: Can be specified multiple times.
+
 `-w, -work-dir`
 : The directory where intermediate result files are stored.
 
+`-workspace-secret`
+: :::{versionadded} 26.04.0
+  :::
+: Name of workspace secret to use in the pipeline.
+: Can be specified multiple times.
+
 `-workspace`
 : The Seqera Platform workspace name.
 

modules/nextflow/src/main/groovy/nextflow/cli/CmdLaunch.groovy

@@ -86,6 +86,12 @@ class CmdLaunch extends CmdBase implements UsageAware {
     @Parameter(names = ['-main-script'], description = 'The script file to be executed when launching a project directory or repository')
     String mainScript
 
+    @Parameter(names = ['-user-secret'], description = 'Specify a user secret name to use in the pipeline (can be specified multiple times)')
+    List<String> userSecrets = []
+
+    @Parameter(names = ['-workspace-secret'], description = 'Specify a workspace secret name to use in the pipeline (can be specified multiple times)')
+    List<String> workspaceSecrets = []
+
     /**
      * Defines the parameters to be passed to the pipeline script
      */
@@ -124,7 +130,9 @@ class CmdLaunch extends CmdBase implements UsageAware {
             stubRun: stubRun,
             mainScript: mainScript,
             params: params,
-            launcher: launcher
+            launcher: launcher,
+            userSecrets: userSecrets,
+            workspaceSecrets: workspaceSecrets
         )
 
         // Execute launch
@@ -156,6 +164,8 @@ class CmdLaunch extends CmdBase implements UsageAware {
         result << '  -latest                   Pull latest changes before run'
         result << '  -stub-run, -stub          Execute the workflow replacing process scripts with command stubs'
         result << '  -main-script <file>       The script file to be executed when launching a project'
+        result << '  -user-secret <name>       User secret name to use in the pipeline (can be specified multiple times)'
+        result << '  -workspace-secret <name>  Workspace secret name to use in the pipeline (can be specified multiple times)'
         result << '  --<param>=<value>         Set a parameter used by the pipeline'
         result << ''
         println result.join('\n').toString()
@@ -191,5 +201,7 @@ class CmdLaunch extends CmdBase implements UsageAware {
         String mainScript
         Map<String, String> params
         Launcher launcher
+        List<String> userSecrets
+        List<String> workspaceSecrets
     }
 }

plugins/nf-tower/src/main/io/seqera/tower/plugin/launch/LaunchCommandImpl.groovy

@@ -229,6 +229,8 @@ class LaunchCommandImpl extends BaseCommandImpl implements CmdLaunch.LaunchComma
         if (paramsText) launch.paramsText = paramsText
         if (options.mainScript) launch.mainScript = options.mainScript
         if (options.entryName) launch.entryName = options.entryName
+        if (options.userSecrets) launch.userSecrets = options.userSecrets as Set
+        if (options.workspaceSecrets) launch.workspaceSecrets = options.workspaceSecrets as Set
 
         log.debug "Built launch request with ${launch.size()} parameters"
         return [launch: launch]

plugins/nf-tower/src/test/io/seqera/tower/plugin/launch/LaunchCommandImplTest.groovy

@@ -622,6 +622,44 @@ class LaunchCommandImplTest extends Specification {
         request.launch.configText == 'process.cpus = 8'
     }
 
+    def 'should include workspace and user secrets in launch request'() {
+        given:
+        def cmd = new LaunchCommandImpl()
+        def options = new CmdLaunch.LaunchOptions(
+            pipeline: 'nf-core/rnaseq',
+            userSecrets: ['MY_USER_SECRET'],
+            workspaceSecrets: ['DRAGEN_USERNAME', 'DRAGEN_PASSWORD']
+        )
+        def context = new LaunchCommandImpl.LaunchContext(
+            computeEnvId: 'ce-123',
+            workDir: 's3://bucket/work'
+        )
+
+        when:
+        def request = cmd.buildLaunchRequestPayload(options, context, 'https://github.com/nf-core/rnaseq', null, null)
+
+        then:
+        request.launch.userSecrets == ['MY_USER_SECRET'] as Set
+        request.launch.workspaceSecrets == ['DRAGEN_USERNAME', 'DRAGEN_PASSWORD'] as Set
+    }
+
+    def 'should not include secrets in launch request when none provided'() {
+        given:
+        def cmd = new LaunchCommandImpl()
+        def options = new CmdLaunch.LaunchOptions(pipeline: 'nf-core/rnaseq')
+        def context = new LaunchCommandImpl.LaunchContext(
+            computeEnvId: 'ce-123',
+            workDir: 's3://bucket/work'
+        )
+
+        when:
+        def request = cmd.buildLaunchRequestPayload(options, context, 'https://github.com/nf-core/rnaseq', null, null)
+
+        then:
+        !request.launch.containsKey('userSecrets')
+        !request.launch.containsKey('workspaceSecrets')
+    }
+
     // ===== Workflow Status Tests =====
 
     def 'should get color for workflow status'() {