[OpenTelemetry] Resolve inline Secret placeholders in openTelemetryProperties

[stankiewicz]

Summary

Allows referencing secrets managed by Beam's Secret framework (e.g., GcpSecret / GoogleCloudSecretManager) inline inside --openTelemetryProperties values so sensitive tokens (such as OTLP exporter authentication headers) do not need to be passed in plaintext in PipelineOptions.

Details

• Updates SdkHarnessOptions.configureOpenTelemetry(PipelineOptions) to resolve inline ${type:<secret_type>;<secret_param>:<value>} placeholders via Secret.parseSecretOption(String) when populating JVM system properties on the worker.
• Example usage:

--openTelemetryProperties={"otel.exporter.otlp.metrics.headers":"api-key=${type:GcpSecret;version_name:projects/my-project/secrets/my-secret/versions/latest}"}

• Trims surrounding whitespace/newlines from fetched secret payloads and quotes regex replacement metacharacters ($ and \).
• Leaves non-secret placeholders (such as ${ENV_VAR}) unchanged and preserves the unresolved placeholder in PipelineOptions.
• Adds unit tests in SdkHarnessOptionsTest covering plain strings, non-secret placeholders, single and multiple ${type:...} placeholders, whitespace/newline trimming, $ and \ escaping, invalid secret types, and configureOpenTelemetry system property initialization.

[github-actions]

📋 Review Summary

This PR adds support for resolving Beam Secret placeholders (${type:<secret_type>;...}) in OpenTelemetry properties configured via SdkHarnessOptions. The implementation is clean, avoids mutating PipelineOptions (preventing secret leakage into serialized options), properly handles special regex characters and trailing whitespace, and includes comprehensive unit test coverage.

🔍 General Feedback

• The secret resolution logic in SdkHarnessOptions.resolveOpenTelemetryPropertyValue is well-scoped to only match ${type:...} placeholders, leaving other ${...} expressions intact.
• Good use of Matcher.quoteReplacement and .trim() when substituting secret values into property strings.
• Unit tests in SdkHarnessOptionsTest thoroughly cover plain values, single and multiple secret placeholders, special characters, invalid secret types, and non-mutation of PipelineOptions.

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

[codecov]

Codecov Report

❌ Patch coverage is 86.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.05%. Comparing base (76f6e6d) to head (eca006b).
⚠️ Report is 164 commits behind head on master.

Files with missing lines	Patch %	Lines
...org/apache/beam/sdk/options/SdkHarnessOptions.java	86.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #40579      +/-   ##
============================================
+ Coverage     56.16%   65.05%   +8.88%     
- Complexity     2288    13976   +11688     
============================================
  Files          1124     1729     +605     
  Lines        178336   108481   -69855     
  Branches       1489    11308    +9819     
============================================
- Hits         100170    70575   -29595     
+ Misses        75645    33691   -41954     
- Partials       2521     4215    +1694     

Flag	Coverage Δ
go	?
java	65.05% <86.66%> (-10.74%)	⬇️
python	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.