gh aw upgrade: still warns 'Remove unsafe secrets from engine.env' despite fix in #29378 for compile

[MauroDruwel]

Bug Report

Description

In #29378, the recommendation was to use engine.env secrets for BYOK variables, and it was confirmed that gh aw compile correctly handles these without treating them as unsafe.

However, gh aw upgrade was not updated with the same logic — it specifically flags COPILOT_PROVIDER_API_KEY as a security violation and removes it, producing:

✓ grumpy-reviewer.md
  • Remove unsafe secrets from engine.env

Steps to Reproduce

1. Configure a workflow .md file with the BYOK pattern as recommended in docs: COPILOT_PROVIDER_* variables not documented and strict-mode allowlist not updated #29378:

   engine:
     id: copilot
     env:
       COPILOT_PROVIDER_BASE_URL: ${{ vars.PROVIDER_BASE_URL }}
       COPILOT_MODEL: ${{ vars.PROVIDER_MODEL }}
       COPILOT_PROVIDER_API_KEY: ${{ secrets.PROVIDER_API_KEY }}

2. Run gh aw compile — passes without security warning ✅
3. Run gh aw upgrade — removes COPILOT_PROVIDER_API_KEY from engine.env with the unsafe secrets warning ❌

Expected Behavior

gh aw upgrade should apply the same allowlist/security rules as gh aw compile and not strip COPILOT_PROVIDER_API_KEY from engine.env, since it is explicitly required for BYOK to function.

Actual Behavior

gh aw upgrade removes COPILOT_PROVIDER_API_KEY from engine.env and outputs:

✓ grumpy-reviewer.md
  • Remove unsafe secrets from engine.env

Additional Context

• Only COPILOT_PROVIDER_API_KEY is stripped — COPILOT_PROVIDER_BASE_URL and COPILOT_MODEL are left untouched.
• The fix in docs: COPILOT_PROVIDER_* variables not documented and strict-mode allowlist not updated #29378 only landed for the compile path. The upgrade command has its own separate validation that was not updated.
• This is confusing and breaks BYOK silently: compile succeeds cleanly while upgrade removes the key that makes BYOK work.