ci: scope integration-test secrets to the steps that use them and address SAST findings

.github/dependabot.yml

@@ -7,4 +7,4 @@ updates:
     schedule:
       interval: 'daily'
     cooldown:
-      default-days: 1
+      default-days: 7

.github/workflows/CI_pypi_release.yml

@@ -43,14 +43,18 @@ jobs:
           pip install hatch requests --uploaded-prior-to=P1D
 
       - name: Validate version number
-        run: python .github/utils/validate_version.py --tag ${{ github.ref_name }}
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: python .github/utils/validate_version.py --tag "$REF_NAME"
 
       - name: Get project folder
         id: pathfinder
         shell: python
+        env:
+          REF_NAME: ${{ github.ref_name }}
         run: |
           import os
-          project_path = "${{ github.ref_name }}".rsplit("-", maxsplit=1)[0]
+          project_path = os.environ["REF_NAME"].rsplit("-", maxsplit=1)[0]
           with open(os.environ['GITHUB_OUTPUT'], 'a') as f:
             print(f'project_path={project_path}', file=f)
 

.github/workflows/aimlapi.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  AIMLAPI_API_KEY: ${{ secrets.AIMLAPI_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -106,6 +105,8 @@ jobs:
           path: python-coverage-comment-action-aimlapi.txt
 
       - name: Run integration tests
+        env:
+          AIMLAPI_API_KEY: ${{ secrets.AIMLAPI_API_KEY }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage
@@ -128,6 +129,8 @@ jobs:
       # Since this integration inherits from OpenAIChatGenerator, we run ALL tests with Haystack main branch to catch regressions
       - name: Nightly - run tests with Haystack main branch
         if: github.event_name == 'schedule'
+        env:
+          AIMLAPI_API_KEY: ${{ secrets.AIMLAPI_API_KEY }}
         run: |
           hatch env prune
           hatch -e test env run -- uv pip install git+https://github.com/deepset-ai/haystack.git@main

.github/workflows/amazon_bedrock.yml

@@ -37,9 +37,7 @@ env:
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
   AWS_REGION: "us-east-1"
-  AWS_BEDROCK_GUARDRAIL_ID: ${{ secrets.AWS_BEDROCK_GUARDRAIL_ID }}
   AWS_BEDROCK_GUARDRAIL_VERSION: "1"
-  S3_DOWNLOADER_BUCKET: ${{ secrets.S3_DOWNLOADER_BUCKET }}
 
 jobs:
   compute-test-matrix:
@@ -125,6 +123,9 @@ jobs:
 
       - name: Run integration tests
         if: success() && steps.aws-auth.outcome == 'success'
+        env:
+          AWS_BEDROCK_GUARDRAIL_ID: ${{ secrets.AWS_BEDROCK_GUARDRAIL_ID }}
+          S3_DOWNLOADER_BUCKET: ${{ secrets.S3_DOWNLOADER_BUCKET }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage

.github/workflows/anthropic.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -106,6 +105,8 @@ jobs:
           path: python-coverage-comment-action-anthropic.txt
 
       - name: Run integration tests
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage

.github/workflows/arcadedb.yml

@@ -26,8 +26,6 @@ env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
   ARCADEDB_USERNAME: "root"
-  # Only set in main repo (secrets not passed to fork workflows); integration tests skip when unset
-  ARCADEDB_PASSWORD: ${{ secrets.ARCADEDB_PASSWORD }}
   TEST_MATRIX_OS: '["ubuntu-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -111,6 +109,9 @@ jobs:
           path: python-coverage-comment-action-arcadedb.txt
 
       - name: Run integration tests
+        env:
+          # Only set in main repo (secrets not passed to fork workflows); integration tests skip when unset
+          ARCADEDB_PASSWORD: ${{ secrets.ARCADEDB_PASSWORD }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage

.github/workflows/azure_ai_search.yml

@@ -25,8 +25,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  AZURE_AI_SEARCH_API_KEY: ${{ secrets.AZURE_AI_SEARCH_API_KEY }}
-  AZURE_AI_SEARCH_ENDPOINT: ${{ secrets.AZURE_AI_SEARCH_ENDPOINT }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -103,6 +101,9 @@ jobs:
           path: python-coverage-comment-action-azure_ai_search.txt
 
       - name: Run integration tests
+        env:
+          AZURE_AI_SEARCH_API_KEY: ${{ secrets.AZURE_AI_SEARCH_API_KEY }}
+          AZURE_AI_SEARCH_ENDPOINT: ${{ secrets.AZURE_AI_SEARCH_ENDPOINT }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage

.github/workflows/azure_doc_intelligence.yml

@@ -25,8 +25,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  AZURE_DI_ENDPOINT: ${{ secrets.AZURE_DI_ENDPOINT }}
-  AZURE_AI_API_KEY: ${{ secrets.AZURE_AI_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -103,6 +101,9 @@ jobs:
           path: python-coverage-comment-action-azure_doc_intelligence.txt
 
       - name: Run integration tests
+        env:
+          AZURE_DI_ENDPOINT: ${{ secrets.AZURE_DI_ENDPOINT }}
+          AZURE_AI_API_KEY: ${{ secrets.AZURE_AI_API_KEY }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage

.github/workflows/azure_form_recognizer.yml

@@ -25,8 +25,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  CORE_AZURE_CS_ENDPOINT: ${{ secrets.CORE_AZURE_CS_ENDPOINT }}
-  CORE_AZURE_CS_API_KEY: ${{ secrets.CORE_AZURE_CS_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -103,6 +101,9 @@ jobs:
           path: python-coverage-comment-action-azure_form_recognizer.txt
 
       - name: Run integration tests
+        env:
+          CORE_AZURE_CS_ENDPOINT: ${{ secrets.CORE_AZURE_CS_ENDPOINT }}
+          CORE_AZURE_CS_API_KEY: ${{ secrets.CORE_AZURE_CS_API_KEY }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage

.github/workflows/brave.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  BRAVE_API_KEY: ${{ secrets.BRAVE_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -104,6 +103,8 @@ jobs:
           path: python-coverage-comment-action-brave.txt
 
       - name: Run integration tests
+        env:
+          BRAVE_API_KEY: ${{ secrets.BRAVE_API_KEY }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage
@@ -125,6 +126,8 @@ jobs:
 
       - name: Nightly - run tests with Haystack main branch
         if: github.event_name == 'schedule'
+        env:
+          BRAVE_API_KEY: ${{ secrets.BRAVE_API_KEY }}
         run: |
           hatch env prune
           hatch -e test env run -- uv pip install git+https://github.com/deepset-ai/haystack.git@main

.github/workflows/chonkie.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  HF_TOKEN: ${{ secrets.HF_TOKEN }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.13"]'
 
@@ -106,6 +105,8 @@ jobs:
 
       - name: Run integration tests
         run: hatch run test:integration-cov-append-retry
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
       - name: Store combined coverage
         if: github.event_name == 'push'

.github/workflows/cognee.yml

@@ -29,8 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  # cognee runs an LLM internally for remember/recall/improve; the integration suite needs a key.
-  LLM_API_KEY: ${{ secrets.OPENAI_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -108,6 +106,9 @@ jobs:
 
       - name: Run integration tests
         run: hatch run test:integration-cov-append-retry
+        env:
+          # cognee runs an LLM internally for remember/recall/improve; the integration suite needs a key.
+          LLM_API_KEY: ${{ secrets.OPENAI_API_KEY }}
 
       - name: Store combined coverage
         if: github.event_name == 'push'

.github/workflows/cohere.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -107,6 +106,8 @@ jobs:
 
       - name: Run integration tests
         run: hatch run test:integration-cov-append-retry
+        env:
+          COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
 
       - name: Store combined coverage
         if: github.event_name == 'push'

.github/workflows/cometapi.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  COMET_API_KEY: "${{ secrets.COMET_API_KEY }}"
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -107,6 +106,8 @@ jobs:
 
       - name: Run integration tests
         run: hatch run test:integration-cov-append-retry
+        env:
+          COMET_API_KEY: "${{ secrets.COMET_API_KEY }}"
 
       - name: Store combined coverage
         if: github.event_name == 'push'
@@ -128,6 +129,8 @@ jobs:
       # Since this integration inherits from OpenAIChatGenerator, we run ALL tests with Haystack main branch to catch regressions
       - name: Nightly - run tests with Haystack main branch
         if: github.event_name == 'schedule'
+        env:
+          COMET_API_KEY: "${{ secrets.COMET_API_KEY }}"
         run: |
           hatch env prune
           hatch -e test env run -- uv pip install git+https://github.com/deepset-ai/haystack.git@main

.github/workflows/deepeval.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -106,6 +105,8 @@ jobs:
 
       - name: Run integration tests
         run: hatch run test:integration-cov-append-retry
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
 
       - name: Store combined coverage
         if: github.event_name == 'push'

.github/workflows/dspy.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -107,6 +106,8 @@ jobs:
 
       - name: Run integration tests
         run: hatch run test:integration-cov-append-retry
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
 
       - name: Store combined coverage
         if: github.event_name == 'push'

.github/workflows/e2b.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  E2B_API_KEY: ${{ secrets.E2B_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -61,6 +60,12 @@ jobs:
         os: ${{ fromJSON(needs.compute-test-matrix.outputs.os) }}
         python-version: ${{ fromJSON(needs.compute-test-matrix.outputs.python-version) }}
 
+    # Scoped to this job (not the workflow-level env) so the secret is not exposed to other
+    # jobs, while remaining available to the "Run integration tests" step's `if:` condition
+    # (a step's own step-level env is not in scope for that same step's `if`).
+    env:
+      E2B_API_KEY: ${{ secrets.E2B_API_KEY }}
+
     steps:
       - name: Support longpaths
         if: matrix.os == 'windows-latest'

.github/workflows/fastembed.yml

@@ -23,7 +23,6 @@ defaults:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  HF_TOKEN: ${{ secrets.HF_TOKEN }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.13"]'
 
@@ -95,6 +94,8 @@ jobs:
 
       - name: Run integration tests
         run: hatch run test:integration-cov-append-retry
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
       - name: Store combined coverage
         if: github.event_name == 'push'

.github/workflows/firecrawl.yml

@@ -25,7 +25,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  FIRECRAWL_API_KEY: ${{ secrets.FIRECRAWL_API_KEY }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -101,6 +100,8 @@ jobs:
           path: python-coverage-comment-action-firecrawl.txt
 
       - name: Run integration tests
+        env:
+          FIRECRAWL_API_KEY: ${{ secrets.FIRECRAWL_API_KEY }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage

.github/workflows/google_genai.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  GOOGLE_API_KEY: "${{ secrets.GOOGLE_API_KEY }}"
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -106,6 +105,8 @@ jobs:
           path: python-coverage-comment-action-google_genai.txt
 
       - name: Run integration tests
+        env:
+          GOOGLE_API_KEY: "${{ secrets.GOOGLE_API_KEY }}"
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage

.github/workflows/huggingface_api.yml

@@ -29,7 +29,6 @@ concurrency:
 env:
   PYTHONUNBUFFERED: "1"
   FORCE_COLOR: "1"
-  HF_TOKEN: ${{ secrets.HF_TOKEN }}
   TEST_MATRIX_OS: '["ubuntu-latest", "windows-latest", "macos-latest"]'
   TEST_MATRIX_PYTHON: '["3.10", "3.14"]'
 
@@ -105,6 +104,8 @@ jobs:
           path: python-coverage-comment-action-huggingface_api.txt
 
       - name: Run integration tests
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
         run: hatch run test:integration-cov-append-retry
 
       - name: Store combined coverage