[Bug]: installApps secret placeholder works when embedded in URL, but not when secret contains the full URL

[youngdanger2]

AL-Go version

9.0

Describe the issue

installApps / installTestApps support secret substitution when the secret placeholder is used inside a URL string, but not when the secret value is the entire URL.

This seems inconsistent with the AL-Go release notes, which say a GitHub secret specification can be used “as part of or as the full URL” for apps to install.

Expected behavior

I expected both of these forms to work:

"installApps": [
"https://host/path/file.app?${{SECRETNAME}}"
]

and

"installApps": [
"${{SECRETNAME}}"
]

when the secret value is the full secure URL.

Steps to reproduce

In settings.json, this did not work:

"installApps": [
"${{URITEST}}"
]

Where URITEST contains the full Azure Blob SAS URL to the .app file.

The workflow log shows it being treated as a local path:

Downloading dependencies from settings (installApps and installTestApps)
Processing installApps entry: ${{URITEST}}
Warning: No files found at local path: ${{URITEST}}

However, this did work where URISECRET only includes the sas token:

"installApps": [
"https://x.blob.core.windows.net/x/x.app?${{URISECRET}}"
]

Additional context (logs, screenshots, etc.)

No response

[aholstrup1]

I can see this indeed used to be the case but as part of some refactoring that behavior was removed. The setting does seem to be documented correctly under https://aka.ms/algosettings#installApps.

We can probably add it back to ensure backwards compatibility; however, I would recommend just keeping the secret portion of the URL as a secret rather than the full URL.

Just to understand your use-case better: What's the reason you want to put the full URL as a secret?

[youngdanger2]

Our scenario is that several repositories depend on the same app source runtime artifacts.

We were hoping to keep the full SAS URL in a single secret so we could update the dependency location centrally, rather than changing configuration in each repo whenever the URL changes.

So for us the value is mainly centralized maintenance across many repos.

I know that we could just keep the container and blobname static (AppName.Latest.App). However it just seemed easier to us to keep the full URL in the secret.
@aholstrup1