fix: preserve --env secrets when config defines secrets (#460)

* fix: preserve --env secrets when config defines secrets

Union env-derived secret names with merged config secrets so file-level  no longer drops build-time env vars. Add a regression test that covers this merge behavior.

* refactor(core): use slices.Concat for merging secrets and update tests

Generated-by: aiautocommit

* refactor(core): inline mergeSecrets helper function

Generated-by: aiautocommit

---------

Co-authored-by: Michael Bianco <[email protected]>

core/core.go

@@ -158,6 +158,8 @@ func GetConfig(app *app.App, env *app.Environment, options *GenerateBuildPlanOpt
 	}
 
 	mergedConfig := c.Merge(optionsConfig, envConfig, fileConfig)
+	// Environment-provided secrets must remain available when file configuration replaces slice values.
+	mergedConfig.Secrets = utils.RemoveDuplicates(slices.Concat(envConfig.Secrets, mergedConfig.Secrets))
 
 	return mergedConfig, nil
 }

core/core_test.go

@@ -93,6 +93,35 @@ func TestGenerateConfigFromFile_Malformed(t *testing.T) {
 	require.Nil(t, cfg, "config should be nil on error")
 }
 
+func TestGetConfig_MergesEnvironmentAndFileSecrets(t *testing.T) {
+	tempDir := t.TempDir()
+	configPath := filepath.Join(tempDir, defaultConfigFileName)
+	err := os.WriteFile(configPath, []byte(`{"secrets":["VITE_APP_TITLE","FILE_ONLY_SECRET"]}`), 0644)
+	require.NoError(t, err)
+
+	userApp, err := app.NewApp(tempDir)
+	require.NoError(t, err)
+
+	envVars := map[string]string{
+		"DATABASE_URL":      "postgres://localhost/mydb",
+		"SENTRY_AUTH_TOKEN": "sntrx_abc",
+		"VITE_APP_TITLE":    "MyApp",
+		"MY_SECRET":         "s3cret",
+	}
+
+	env := app.NewEnvironment(&envVars)
+	config, err := GetConfig(userApp, env, &GenerateBuildPlanOptions{}, logger.NewLogger())
+	require.NoError(t, err)
+
+	require.ElementsMatch(t, []string{
+		"DATABASE_URL",
+		"SENTRY_AUTH_TOKEN",
+		"VITE_APP_TITLE",
+		"MY_SECRET",
+		"FILE_ONLY_SECRET",
+	}, config.Secrets)
+}
+
 func TestGenerateBuildPlan_DockerignoreMetadata(t *testing.T) {
 	appPath := "../examples/dockerignore"
 	userApp, err := app.NewApp(appPath)