fix(secrets): resolve secret references inside configuration lists

[HootRock]

Configurations such as {"tokens": ["secret_reference::TOKEN"]} currently retain the reference instead of resolving it. Nested lists are skipped as well, so validation and the configuration passed to a connector can receive unresolved references.

Walk dictionary values and list elements with the same recursive logic. This keeps the public dictionary API, copied-input behavior, existing missing-secret errors and SecretString masking. The tests use real environment-backed secret lookup, including nested lists/dictionaries and ordinary values.

This addresses the shared-hydration follow-up explicitly noted in #1387; the original secret-reference support was introduced in #696. It targets main as a current-release bug fix, following the documented automatic sync into release-candidate/v1.

Validation on Python 3.12.12 with frozen dependencies:

• New regressions on unmodified main: 5 failed, 3 passed; after the fix: 8 passed (also independently run during review).
• Offline ConnectorBase.set_config(validate=True) probe: flat/nested lists both fail before the patch and pass after it; the execution configuration resolves them and the caller's input is retained. No live connector or Cloud calls.
• Whole-repository Ruff lint/format, pyrefly check, and git diff --check: passed.
• Broader unit run with external sockets blocked: 1280 passed, 1 skipped, 2 failed. test_connector_resolution_validates_workspace_scope[connector_in_other_workspace] reaches an unmocked Cloud inspect request on unmodified main too; test_get_time_str expects UTC but this Windows host uses UTC+8. The full suite is not claimed green.

AI-assisted implementation and regression tests with Codex; independently reviewed.

reviewed and tested locally.

[octavia-bot]

Note

📝 PR Converted to Draft

More info...

Thank you for creating this PR. As a policy to protect our engineers' time, Airbyte requires all PRs to be created first in draft status. Your PR has been automatically converted to draft status in respect for this policy.

As soon as your PR is ready for formal review, you can proceed to convert the PR to "ready for review" status by clicking the "Ready for review" button at the bottom of the PR page.

To skip draft status in future PRs, please include [ready] in your PR title or add the skip-draft-status label when creating your PR.

[github-actions]

👋 Welcome to PyAirbyte!

Thank you for your contribution from HootRock/PyAirbyte! We're excited to have you in the Airbyte community.

💡 Show Tips and Tricks

Testing This PyAirbyte Version

You can test this version of PyAirbyte using the following:

# Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/HootRock/PyAirbyte.git@fix/hydrate-secret-reference-lists-main' pyairbyte --help

# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/HootRock/PyAirbyte.git@fix/hydrate-secret-reference-lists-main'

PR Slash Commands

As needed or by request, Airbyte Maintainers can execute the following slash commands on your PR:

• /fix-pr - Fixes most formatting and linting issues
• /uv-lock - Updates uv.lock file
• /test-pr - Runs tests with the updated PyAirbyte
• /prerelease - Builds and publishes a prerelease version to PyPI
• /evals - Runs the Cloud MCP evals that use the MCP tools this PR changed (/evals full=true runs the full suite)

📚 Show Repo Guidance

Helpful Resources

• Contributing Guidelines
• PyAirbyte Documentation
• API Reference

If you have any questions, feel free to ask in the PR comments or join our community:

• Airbyte Slack - Join the #pyairbyte channel
• GitHub Discussions

📝 Edit this welcome message.