Replace configuration and secret loading globals

internal/app/secrets_env.go

@@ -13,7 +13,6 @@ import (
 )
 
 var envVarNamePattern = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
-var readSecretsDirectoryEntries = os.ReadDir
 
 // APIKeyFileByteLimit bounds one credential value read from the configured
 // secrets directory. API keys are expected to be short single-line values.
@@ -30,6 +29,11 @@ type secretsLoadStats struct {
 }
 
 func loadSecretsFromConfig(cfg *config.Config, logger *slog.Logger) (*secretsLoadStats, error) {
+	return loadSecretsFromConfigWithDependencies(cfg, logger, commandDependencies{})
+}
+
+func loadSecretsFromConfigWithDependencies(cfg *config.Config, logger *slog.Logger, deps commandDependencies) (*secretsLoadStats, error) {
+	deps = normalizeCommandDependencies(deps)
 	if cfg == nil || cfg.Pipeline == nil || cfg.Pipeline.Secrets == nil {
 		return nil, nil
 	}
@@ -60,7 +64,7 @@ func loadSecretsFromConfig(cfg *config.Config, logger *slog.Logger) (*secretsLoa
 		return nil, fmt.Errorf("API-key loader: validate secrets env_dir: %w", err)
 	}
 
-	entries, err := readSecretsDirectoryEntries(resolvedDir)
+	entries, err := deps.readSecretsDirectory(resolvedDir)
 	if err != nil {
 		return nil, fmt.Errorf("API-key loader: read secrets env_dir %q: %w", resolvedDir, err)
 	}