Bootstrap secrets before configuration loading

internal/app/config_commands_test.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 
@@ -91,8 +92,6 @@ func TestConfigValidateAndShowPipelineOnlyAreSideEffectFree(t *testing.T) {
 	defer server.Close()
 	mustWriteTestFile(t, pipelinePath, `workspace:
   root: `+workspaceRoot+`
-secrets:
-  env_dir: `+secretsDir+`
 whisperx:
   transcribe_url: `+server.URL+`
 `)
@@ -276,6 +275,30 @@ func TestConfigDiffReportsEqualityAndRejectsInvalidInput(t *testing.T) {
 	}
 }
 
+func TestConfigDiffBootstrapsSecretsOnceForBothProfiles(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	pipelinePath, _, _ := writeValidConfigFiles(t, workspaceRoot)
+	writeInspectionProfiles(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: fr\n")
+	secretsDir := t.TempDir()
+	bootstrapCalls := 0
+	deps := commandDependencies{loadSecretsDir: func(got string) (*configkit.SecretsReport, error) {
+		bootstrapCalls++
+		if got != secretsDir {
+			t.Fatalf("secrets directory = %q, want %q", got, secretsDir)
+		}
+		return nil, nil
+	}}
+
+	if err := configDiffWithDependencies(context.Background(), []string{
+		"production", "testing", "--config", pipelinePath, "--secrets-dir", secretsDir,
+	}, io.Discard, deps); err != nil {
+		t.Fatalf("config diff: %v", err)
+	}
+	if bootstrapCalls != 1 {
+		t.Fatalf("bootstrap calls = %d, want 1", bootstrapCalls)
+	}
+}
+
 func TestConfigCommandsInspectMaintainedSplitBundleWithoutRuntimeState(t *testing.T) {
 	examplesDir := filepath.Join("..", "..", "examples")
 	pipelinePath := filepath.Join(examplesDir, "production-testing", "pipeline.yml")