From 0c1112789750f1d32316fb70f0e893eb2710f598 Mon Sep 17 00:00:00 2001
From: Ben Sherman <bentshermann@gmail.com>
Date: Mon, 7 Jul 2025 11:46:10 -0500
Subject: [PATCH] Ignore secrets in stub run

Signed-off-by: Ben Sherman <bentshermann@gmail.com>
---
 .../groovy/nextflow/executor/BashWrapperBuilder.groovy     | 2 +-
 .../src/main/groovy/nextflow/processor/TaskBean.groovy     | 7 ++++++-
 .../src/main/groovy/nextflow/processor/TaskRun.groovy      | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/modules/nextflow/src/main/groovy/nextflow/executor/BashWrapperBuilder.groovy b/modules/nextflow/src/main/groovy/nextflow/executor/BashWrapperBuilder.groovy
index 793560a61d..12fbfbf717 100644
--- a/modules/nextflow/src/main/groovy/nextflow/executor/BashWrapperBuilder.groovy
+++ b/modules/nextflow/src/main/groovy/nextflow/executor/BashWrapperBuilder.groovy
@@ -117,7 +117,7 @@ class BashWrapperBuilder {
     private BashTemplateEngine engine = new BashTemplateEngine()
 
     BashWrapperBuilder( TaskRun task ) {
-        this(new TaskBean(task))
+        this(task.toTaskBean())
     }
 
     BashWrapperBuilder( TaskBean bean, ScriptFileCopyStrategy strategy = null ) {
diff --git a/modules/nextflow/src/main/groovy/nextflow/processor/TaskBean.groovy b/modules/nextflow/src/main/groovy/nextflow/processor/TaskBean.groovy
index 6c63e6bae5..4f45565f91 100644
--- a/modules/nextflow/src/main/groovy/nextflow/processor/TaskBean.groovy
+++ b/modules/nextflow/src/main/groovy/nextflow/processor/TaskBean.groovy
@@ -123,6 +123,10 @@ class TaskBean implements Serializable, Cloneable {
     }
 
     TaskBean(TaskRun task) {
+        this(task, false)
+    }
+
+    TaskBean(TaskRun task, boolean stubRun) {
 
         this.name = task.name
 
@@ -154,9 +158,10 @@ class TaskBean implements Serializable, Cloneable {
         this.containerEnabled = task.isContainerEnabled()
         this.containerOptions = task.config.getContainerOptions()
         this.containerPlatform = task.getContainerPlatform()
+
         // secret management
         this.secretNative = task.isSecretNative()
-        this.secretNames = task.config.getSecret()
+        this.secretNames = stubRun ? task.config.getSecret() : null
 
         // stats
         this.outputEnvNames = task.getOutputEnvNames()
diff --git a/modules/nextflow/src/main/groovy/nextflow/processor/TaskRun.groovy b/modules/nextflow/src/main/groovy/nextflow/processor/TaskRun.groovy
index 20ab76ec36..6ef9f003a9 100644
--- a/modules/nextflow/src/main/groovy/nextflow/processor/TaskRun.groovy
+++ b/modules/nextflow/src/main/groovy/nextflow/processor/TaskRun.groovy
@@ -984,7 +984,7 @@ class TaskRun implements Cloneable {
     }
 
     TaskBean toTaskBean() {
-        return new TaskBean(this)
+        return new TaskBean(this, processor.session.stubRun)
     }
 
     CondaConfig getCondaConfig() {