perf(secrets): prune disabled/paused pipelines by default in discovery, add --include-disabled opt-out

[Copilot]

Summary

secrets set/list/delete --all-repos issues one ADO Pipeline Preview call per definition in the project — the dominant cost on large projects — including pipelines that are disabled or paused. This makes pruning inactive definitions before the Preview fan-out the default behavior, where the time is actually spent, and adds an opt-out --include-disabled flag for when you need to operate on inactive pipelines too.

• Filter (src/ado/discovery.rs) — New is_active_definition helper drops definitions whose queueStatus is disabled or paused, applied by default after scope filtering and before the per-definition Preview calls in discover_ado_aw_pipelines. Matching is case-insensitive; a missing/None status is treated as active so definitions the API didn't annotate are never silently skipped.
• Plumbing — include_disabled threaded through resolve_definitions_via_discovery, secrets::resolve_for_command, and the Set/List/Delete option structs.
• CLI (src/main.rs) — --include-disabled flag added to secrets set/list/delete. Only takes effect on the discovery code path (--all-repos or --source); passing it restores Previewing of every in-scope definition.
• Docs — Documented in the secrets command list and the Project-scope discovery section of docs/cli.md.

Active-only is the default — large --all-repos runs skip disabled/paused pipelines automatically. paused is treated as inactive since paused pipelines won't queue new runs.

ado-aw secrets set GITHUB_TOKEN --all-repos --include-disabled

Test plan

• cargo test — added unit tests covering enabled/disabled/paused/None/unknown statuses, case-insensitivity, and collection pruning.
• cargo build, cargo clippy --all-targets --all-features — clean.

[jamesadevine]

@copilot active-only should be the default! Explicit cli flag to include disabled pipelines, please instead.

[jamesadevine]

/rust-review

[github-actions]

✅ Rust PR Reviewer completed successfully!

[Copilot]

@copilot active-only should be the default! Explicit cli flag to include disabled pipelines, please instead.

Inverted the behavior: disabled/paused pipelines are now pruned by default, and there's an explicit --include-disabled flag to opt back into Previewing them. Done in 84e8f5e (and the branch-order cleanup follow-up).

[github-actions]

🔍 Rust PR Review

Summary: Looks good — correct, secure, and well-tested. One clap consistency gap worth fixing.

Findings

⚠️ Suggestions

• src/main.rs — --include-disabled missing conflicts_with = "definition_ids"

  Every other discovery flag (--all-repos, --source) declares conflicts_with = "definition_ids", which makes sense: if the user supplies explicit IDs, --include-disabled is silently ignored (the code falls through to the legacy path at secrets.rs:285 and include_disabled is never consumed). Passing --include-disabled --definition-ids 42 currently does nothing but emits no warning.

  Consistent fix — add to all three subcommand variants:

  #[arg(long, conflicts_with = "definition_ids")]
  include_disabled: bool,

  Clap will then reject the combination with a clear error message rather than silently ignoring the flag.

• src/secrets.rs:191 — #[allow(clippy::too_many_arguments)] signals a refactor opportunity

  resolve_for_command now has 8 parameters. Not a blocker, but the existing SetOptions/ListOptions/DeleteOptions option-struct pattern used by callers could be threaded through here too (a single &ResolveOptions<'_> instead of 8 positional args). Optional future cleanup — no need to address in this PR.

✅ What Looks Good

• is_active_definition treating None as active is the right fail-safe: definitions the API didn't annotate are never silently excluded.
• Case-insensitive matching with eq_ignore_ascii_case is robust to API casing variations.
• The filter is applied after apply_scope_filter and before the expensive Preview fan-out — exactly where the speedup matters.
• Unit tests cover enabled, disabled, paused, None, unknown status, case-insensitivity, and collection pruning.
• run_set_github_token correctly defaults to include_disabled: false.
• Debug log at discovery.rs:258 is appropriately helpful (count + how to opt out).

Generated by Rust PR Reviewer for issue #914 · sonnet46 893.4K · ◷