[Vivswan]

What this changes

before:  secretValuesOf(declared: unknown, extract: (entry: Record<string, unknown>) => ...)
             typeof declared === "object" && !Array.isArray(declared) && Array.isArray(declared.entries) ...
             typeof entry === "object" && entry !== null && !Array.isArray(entry) ? extract(entry) : []

after:   secretValuesOf<E>(declared: readonly E[] | { readonly entries: readonly E[] }, extract: (entry: E) => ...)
             listEntries(declared).flatMap(extract)

How

• The signature is the declared list form listEntries() already models, so the extract callback gets the section's entry type.
• listSecretValues takes SecretEntry[] | UndeclaredPolicyList<SecretEntry> and drops its string checks on name and value.
• The environments hook drops the cast and the name guard, keeping only the optional secrets branch.
• secretValuesFor passes ErasedDeclared and keeps the narrowings valueAt()'s erased walk needs.
• gated() constrains its parameter to all-function members and drops the typeof helper branch neither call site could take.
• A caller that breaks the type with null or undefined through any now gets a TypeError from listEntries instead of an empty list. The type is the fix. A scalar still returns [] as before.

Proof

• Targeted tests: 313 pass across contract, environments, webhooks, shared, labels, validate, and engine secrets.
• e2e: 69/69 scenarios for environments, actions_secrets, and webhooks.
• Gates: tsc, biome, lint:arch, knip green.

Technical details

• Line accounting: src 43 added and 60 removed over five files, tests 2 added and 17 removed over two files.
• Census, module.ts: Array.isArray 9 -> 5, typeof 8 -> 6, declared: unknown 1 -> 0.
• Census, list-section.ts: declared: unknown 1 -> 0, typeof 2 -> 2 (the valueAt narrowings stay).
• Census, environments/index.ts: typeof 4 -> 3, declared: unknown 1 -> 0.
• Census, secrets-engine.ts: typeof 6 -> 4, declared: unknown 1 -> 0.
• Census, plan.ts: typeof helper 1 -> 0.
• Census, tests: as unknown as casts feeding secretValues 2 -> 0 in environments.test.ts, 1 -> 0 in webhooks.test.ts.
• Deleted test: webhooks "malformed containers return []" fed null, strings, numbers, and an entries-less wrapper through a double cast, and no producer hands the hook such a value.
• Narrowed test: environments "survives malformed containers" keeps the bare list, the {entries} wrapper, and an entry without secrets, which are the three real nested forms.
• Producers traced: validateSectionShapes calls the hook after the shape parse succeeded, collectSecretReferences takes ValidatedSettings, repo-secrets assigns listSecretValues as a typed member.
• Deliberate reading: engine/validate.ts keeps its secretValues?(declared: unknown) cast, the engine's documented re-widening of the registry's generic view.
• Deliberate reading: listEntries keeps its entries fallback, since a shape rule in raw-values.ts reads a wrapper whose entries may be raw or missing beside its own shape issue.
• Deliberate reading: the valueAt() typeof checks in secretValuesFor narrow an unknown the erased path walk returns, so they are not twins of the shape.
• Recorded, not built: runtime defenses for a library caller that bypasses the public SectionModule type with any.
• Files: src/sections/contract/{module.ts,plan.ts}, src/sections/shared/{list-section.ts,secrets-engine.ts}, src/sections/environments/index.ts, test/sections/{environments/environments.test.ts,webhooks/webhooks.test.ts}.

[Copilot]

Copilot review overview

🟢 Approval recommended

Validated extraction inputs and function-only gated callers support the removed checks, with no unresolved defects identified.

Review effort: Balanced
Findings: None

What changed in this PR

This refactor uses typed section entries for secret extraction, removing redundant runtime checks while preserving validation at the engine boundary.

Changes:

• Give secret extraction helpers typed list signatures.
• Restrict gated ports to function members.
• Update tests to cover supported inputs rather than malformed values passed through casts.

File	Description
test/​sections/​webhooks/​webhooks.test.ts	Remove malformed-container expectations.
test/​sections/​environments/​environments.test.ts	Retain coverage for supported nested secret forms.
src/​sections/​shared/​secrets-engine.ts	Type secret lists and simplify extraction.
src/​sections/​shared/​list-section.ts	Pass the erased declared-list type to extraction.
src/​sections/​environments/​index.ts	Use typed environment entries without casts.
src/​sections/​contract/​plan.ts	Constrain gated helpers to functions.
src/​sections/​contract/​module.ts	Make secret extraction generic and reuse listEntries.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

File size check

0 over a hard cap (fails), 10 warning(s).

File	Size	Tier	Cap
.github/scripts/gen-inputs-table.ts:54	11 comment lines	warn	10
.github/scripts/release-pipeline.ts:1	34 comment lines (header)	warn	25
.github/scripts/release-pipeline.ts:453	14 comment lines	warn	10
docs/upgrading/v2-to-v3.md	1292 lines	warn	1040
src/github/secret-scan.ts:45	11 comment lines	warn	10
src/sections/contract/errors.ts:13	14 comment lines	warn	10
src/sections/shared/roles.ts:43	13 comment lines	warn	10
test/e2e/generators.ts	2634 lines	warn	2560
test/e2e/generators.ts:1667	12 comment lines	warn	10
test/sections/refusal-messages.test.ts:61	19 comment lines	warn	10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.