refactor(secrets): migrate secrets consumers to typed SecretsClient

[maxdubrinsky]

Summary

Migrate secrets API call sites from sdk.secrets.* (Stainless SDK) to client_from_platform(sdk, TypedClient).* (typed HTTP client), following the pattern established in #1277.

Related Issue

AIRCORE-827

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with documentation updates
• Documentation only
• Contributor tooling or automation
• CI, build, or test infrastructure

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: same API calls, different client
• Tests not applicable — justification:
• Documentation updated for user-visible behavior
• Documentation not applicable — justification: internal refactoring

Verification

• Pull request title follows the repository's Conventional Commit format
• Every commit includes an appropriate Signed-off-by: trailer
• uv run pre-commit run -a passes, or any blocked checks are identified below
• Targeted tests pass, or tests are marked not applicable above
• No secrets, API keys, or credentials are included

Summary by CodeRabbit

• Refactor
  • Standardized secret management across credential, job, and storage workflows.
  • Improved consistency for creating, retrieving, listing, and deleting secrets.
• Tests
  • Updated end-to-end and unit coverage for secret handling and storage backend scenarios while preserving expected behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d7d276f2-ffdb-4c0d-85cd-70be192e721e

📥 Commits

Reviewing files that changed from the base of the PR and between 5c6285c and b988e5b.

📒 Files selected for processing (1)

• e2e/test_jobs.py

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The change replaces direct SDK secret and job operations with platform-adapted clients. E2E tests use typed request models and response data extraction. Nemo Iron Swarm secret resolution uses the platform SecretsClient.

Changes

Secrets client migration

Layer / File(s)	Summary
E2E secret fixtures and storage flows e2e/conftest.py, e2e/files/test_storage_backends.py	Fixtures and storage backend tests create and delete secrets through SecretsClient with PlatformSecretCreateRequest.
E2E secrets API tests e2e/test_secrets.py	Secret creation, retrieval, listing, deletion, duplicate checks, and secrecy checks now use SecretsClient.
E2E job client flows e2e/test_jobs.py	Job creation, log retrieval, status checks, cancellation, pause, and resume now use JobsClient. Secret lifecycle checks use SecretsClient.
Plugin secret resolution plugins/nemo-iron-swarm/src/nemo_iron_swarm_plugin/cli/credentials.py, plugins/nemo-iron-swarm/src/nemo_iron_swarm_plugin/jobs/_common.py	Credential and job secret resolution now use platform-adapted SecretsClient.access_secret(...).data() calls.
Plugin resolution tests plugins/nemo-iron-swarm/tests/unit/test_model_config.py, plugins/nemo-iron-swarm/tests/unit/test_operator_env.py	Unit-test doubles and fixtures now route secret access through SecretsClient.access_secret and nested data() responses.

Suggested reviewers: a2bondar

Merge Risk: ⚪ Minimal · up to b988e

This refactoring migrates secrets API call sites to a typed client without any supplied evidence of a concrete merge-blocking risk; no actionable risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 27 functions across 8 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: migrating secrets consumers to the typed SecretsClient.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch aircore-827-migrate-secrets/mdubrinsky

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	35433/45223	78.3%	62.9%
Integration Tests	21119/42998	49.1%	22.3%