feat(cli): rename configure to secrets with subcommands

[jamesadevine]

Summary

Implements PR 8 of the Phase 1 CLI overhaul. Replaces ado-aw configure --token <value> with a secrets subcommand group:

ado-aw secrets set <name> [<value>] [PATH] [flags]
ado-aw secrets list [PATH] [flags]
ado-aw secrets delete <name> [PATH] [flags]

The legacy configure invocation is retained as a hidden alias that prints a stderr deprecation warning and forwards to secrets::run_set_github_token. Existing scripts that call ado-aw configure --token <value> keep working; the warning tells the operator to migrate. The alias will be removed in the next minor release.

Subcommands

• secrets set <name> [<value>] — set a pipeline variable (always isSecret=true). Value resolution: explicit positional <value> → --value-stdin → interactive tty prompt with echo off. --allow-override controls the allowOverride flag on the new variable.
• secrets list — print variable names and their isSecret / allowOverride flags for every matched definition. Never prints values. --json for scripting.
• secrets delete <name> — remove the named variable from every matched definition (no-op when absent).

Safety

• validate_variable_name rejects empty / whitespace-only / whitespace-containing inputs.
• VariableInfo has no value field. A guardrail test asserts the Debug representation never contains a leaked-in value.
• All set/delete operations use the standard match_definitions scoping (with the same --definition-ids escape hatch as the old configure).

Plumbing

• New src/secrets.rs with three pure helpers (apply_variable_set, apply_variable_delete, list_variables, validate_variable_name) covered by 12 unit tests.
• src/configure.rs shrinks from ~140 lines of orchestration to a ~30-line forwarder.
• Commands::Configure is #[command(hide = true)] so it no longer appears in ado-aw --help.

Verified

• cargo build ✅
• cargo clippy --all-targets --all-features ✅
• cargo test ✅ — 12 new unit tests in secrets.rs, 5 integration tests in tests/secrets_integration.rs (covering subcommand help, hidden configure, and the deprecation warning).

Out of scope

PR 9 (help-text grouping), PR 10 (doc overhaul).

[github-actions]

🔍 Rust PR Review

Summary: Solid refactor with a behavioural regression in the deprecation alias and a code-duplication concern worth addressing before merge.

---

Findings

🐛 Bugs / Logic Issues

• src/secrets.rs — run_set_github_token silently resets allowOverride

  The old update_pipeline_variable in src/ado/mod.rs (lines 580–585) preserved the existing allowOverride flag when updating GITHUB_TOKEN:

  let allow_override = definition
      .get("variables")
      .and_then(|vars| vars.get(variable_name))
      .and_then(|var| var.get("allowOverride"))
      .and_then(|v| v.as_bool())
      .unwrap_or(false);

  run_set_github_token now hard-codes allow_override: false, so any pipeline definition that previously had GITHUB_TOKEN { allowOverride: true } will have that flag silently cleared after the first ado-aw configure --token ... invocation post-upgrade. The PR description says the alias is "byte-equivalent" to the old behaviour — it isn't in this respect.

  Fix: either read-back and preserve the existing flag inside run_set_github_token (as the old code did), or document the breaking change explicitly in the deprecation warning.

• src/secrets.rs — run_list fails fast when a single definition is unreachable

  run_set and run_delete both use a fail-soft per-definition loop (counting successes/failures and continuing). run_list does not — if get_definition_full throws for any one definition the entire command exits with an error and the remaining definitions are never printed. The asymmetry will surprise operators with partially-healthy setups.

⚠️ Suggestions

• src/secrets.rs — put_definition duplicates ADO plumbing that belongs in src/ado/mod.rs

  The new private put_definition function re-implements the PUT half of update_pipeline_variable that already lives in the ado module. More importantly, every other ADO URL helper that includes ctx.project in the path percent-encodes it (lines 833, 881, 948, 1001 in src/ado/mod.rs), but put_definition (and the existing update_pipeline_variable) use ctx.project verbatim. Projects with spaces or special characters silently get malformed URLs.

  The right fix is to expose put_definition_full(client, ctx, auth, id, body) from src/ado/mod.rs with proper percent_encoding::utf8_percent_encode(&ctx.project, PATH_SEGMENT) in the URL, and call it from both update_pipeline_variable and the new secrets.rs helpers. This also fixes the pre-existing encoding gap in update_pipeline_variable.

---

✅ What Looks Good

• VariableInfo having no value field with a dedicated guardrail test (variable_info_has_no_value_field_in_debug_repr) is excellent security hygiene — exactly the kind of defence-in-depth the threat model calls for.
• The pure helper functions (apply_variable_set, apply_variable_delete, list_variables) are well-isolated and the 12 unit tests give good coverage.
• validate_variable_name covering whitespace-only, embedded-whitespace, and empty inputs is appropriately strict.
• Hidden configure alias with a stderr deprecation warning pointing at the replacement is the right migration path.
• --value-stdin implementation correctly trims CRLF and bails on empty input.

Generated by Rust PR Reviewer for issue #600 · ● 582.6K · ◷

[jamesadevine]

Superseded by #602 (eat/cli-lifecycle-family), which consolidates all six in-flight Phase 1 lifecycle PRs into a single linear-history branch. Closing this PR; review feedback should land on #602.