feat: add Secret support (Closes #4269)

[Noordsestern]

Closes #4269

The more I think about it, the more corners I imagine where this won't work (do we have dictionaries of secrets, too??).

Anyways, if we have only str values: As far as I see there is 1 place where to choose between Secret or "default" behaviour.

Making a difference between Robot versions in the code looks ugly. I saw it back in the days when Robot supported Python 2. Probably won't work after Robot 10, but until then 7.3 is probably out of support anyway :D

I tested utest with:

• Robot Framework 7.3.2 (expectation: works although Secret type does not exist) 🍏
• Robot Framework 7.4.1 (expectation: work when Secret type exist) 🍏

However, I was not sure how to execute pytest cases based on the Robot version. So, I did not add new pytests for Secret type, yet.

EDIT: I have seen that the pipelines never test with different Robot Framework versions. Maybe that was just never necessary, yet. How should the pytests be set up then? Should there be version specific test cases or only tests compatible with latest Robot Framework version?

Thought I first get your feedback.

[Copilot]

Pull request overview

Adds support for Robot Framework 7.4+ Secret type handling when resolving secrets so that secret values can be extracted safely for keyword execution.

Changes:

• Conditionally imports robot.api.types.Secret based on Robot Framework version.
• Updates resolve_secret() to unwrap Secret instances by returning secret.value.

[Copilot]

robot_version.get_version() is being compared to the string "7.4". Lexicographic string comparison will mis-detect versions like 7.10.x and 10.x (e.g., "10.0" < "7.4"), which would disable Secret support on newer Robot Framework versions. Use a robust check instead (e.g., try/except importing robot.api.types.Secret, or parse the version into numeric parts before comparing).

Suggested change

	if robot_version.get_version() >= "7.4":
	from robot.api.types import Secret
	try:
	from robot.api.types import Secret
	except ImportError:
	pass

[Copilot]

The new Secret-specific behavior in resolve_secret (unwrapping Secret.value) is not covered by the existing unit tests for this method. Add a pytest that conditionally imports robot.api.types.Secret (skip if unavailable) and asserts that passing a Secret (and a dict containing Secret values, if supported) returns plain strings.

[aaltat]

Hi, I will try to look this soon, but some robocon deadlines are lurking and I need to do those things first. Sorry for the delay

[aaltat]

The more I think about it, the more corners I imagine where this won't work (do we have dictionaries of secrets, too??).

Yes there are dictionaries and dictionaries can have secret in it and it should just work.

Anyways, if we have only str values: As far as I see there is 1 place where to choose between Secret or "default" behaviour.

This PR alone is not enough, need to define Secret also in the keywords type annotations (because without the annotation, RF will convert the Secret to str and stuff does not work as expected.) Because we support older versions of RF (but we do not test it in the CI), we need to make our own implementation of Secret until 7.4 is the minimum version.

Because now we have need to test with different RF version, we should do it also in CI.

However, I was not sure how to execute pytest cases based on the Robot version. So, I did not add new pytests for Secret type, yet.

Pytest has skipif decorator https://docs.pytest.org/en/stable/how-to/skipping.html#id1 which is handy for this type of things.

[Noordsestern]

need to define Secret also in the keywords type annotations (because without the annotation, RF will convert the Secret to str and stuff does not work as expected.)

😱 I had done this in my local fix, but somehow not in the PR. I wonder why it still worked then... i think, i must have forgotten that i made fixes and robot test cases in my venv, but then forgot to port the tests and annotations to the PR 😞

Because we support older versions of RF (but we do not test it in the CI), we need to make our own implementation of Secret until 7.4 is the minimum version.

But how would users of RF <7.4 define a Secret?

Because now we have need to test with different RF version, we should do it also in CI.

👍🏻 doubles the amount of test shards, though 😬 but there is no other way.

Pytest has skipif decorator https://docs.pytest.org/en/stable/how-to/skipping.html#id1 which is handy for this type of things.

✅