Allow secrets to be used in pipeline script

docs/secrets.md

@@ -47,7 +47,7 @@ The above snippet access the secrets `MY_ACCESS_KEY` and `MY_SECRET_KEY` previou
 Secrets **cannot** be assigned to pipeline parameters.
 :::
 
-## Process secrets
+## Process directive
 
 Secrets can be access by pipeline processes by using the `secret` directive. For example:
 
@@ -71,3 +71,20 @@ The secrets are made available in the process context running the command script
 :::{note}
 This feature is only available when using the local or grid executors (Slurm, Grid Engine, etc). The AWS Batch executor allows the use of secrets when deploying the pipeline execution via [Nextflow Tower](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
 :::
+
+## Pipeline script
+
+:::{versionadded} 23.09.0-edge
+:::
+
+Secrets can be accessed in the pipeline script using the `secrets` variable. For example:
+
+```groovy
+workflow.onComplete {
+    println("The secret is: ${secrets.MY_SECRET}")
+}
+```
+
+:::{note}
+This feature is only available when using the local or grid executors (Slurm, Grid Engine, etc). The AWS Batch executor allows the use of secrets when deploying the pipeline execution via [Nextflow Tower](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
+:::

modules/nextflow/src/main/groovy/nextflow/script/BaseScript.groovy

@@ -24,6 +24,8 @@ import nextflow.NF
 import nextflow.NextflowMeta
 import nextflow.Session
 import nextflow.exception.AbortOperationException
+import nextflow.secret.SecretsLoader
+import nextflow.secret.SecretsProvider
 /**
  * Any user defined script will extends this class, it provides the base execution context
  *
@@ -85,8 +87,23 @@ abstract class BaseScript extends Script implements ExecutionContext {
         binding.setVariable( 'workDir', session.workDir )
         binding.setVariable( 'workflow', session.workflowMetadata )
         binding.setVariable( 'nextflow', NextflowMeta.instance )
-        binding.setVariable('launchDir', Paths.get('./').toRealPath())
-        binding.setVariable('moduleDir', meta.moduleDir )
+        binding.setVariable( 'launchDir', Paths.get('./').toRealPath() )
+        binding.setVariable( 'moduleDir', meta.moduleDir )
+        binding.setVariable( 'secrets', makeSecretsContext() )
+    }
+
+    def makeSecretsContext() {
+        if( !SecretsLoader.isEnabled() )
+            return null
+
+        return new Object() {
+            private SecretsProvider provider = SecretsLoader.instance.load()
+
+            @Override
+            def getProperty(String name) {
+                provider.getSecret(name)?.value
+            }
+        }
     }
 
     protected process( String name, Closure<BodyDef> body ) {