Forward Scriptorium credentials through the shared adapter path

internal/config/credential_projection.go

@@ -73,6 +73,24 @@ func (cfg NotariusConfig) MarshalYAML() (any, error) {
 	}, nil
 }
 
+// MarshalYAML exposes only public Scriptorium credential reference names.
+func (cfg ScriptoriumConfig) MarshalYAML() (any, error) {
+	type safeScriptorium struct {
+		Binary           string                                     `yaml:"binary"`
+		ConfigPath       string                                     `yaml:"config_path"`
+		Timeout          string                                     `yaml:"timeout"`
+		RenderDebug      bool                                       `yaml:"render_debug"`
+		Credentials      []string                                   `yaml:"credentials,omitempty"`
+		Artifacts        map[string]ScriptoriumArtifactConfig       `yaml:"artifacts"`
+		ArtifactFamilies map[string]ScriptoriumArtifactFamilyConfig `yaml:"artifact_families"`
+	}
+	return safeScriptorium{
+		Binary: cfg.Binary, ConfigPath: cfg.ConfigPath, Timeout: cfg.Timeout,
+		RenderDebug: cfg.RenderDebug, Credentials: secretReferenceNames(cfg.Credentials),
+		Artifacts: cfg.Artifacts, ArtifactFamilies: cfg.ArtifactFamilies,
+	}, nil
+}
+
 func secretReferenceNames(secrets []configkit.Secret) []string {
 	if secrets == nil {
 		return nil