fix(cli): honor task secret opt-in

[goingforstudying-ctrl]

TL;DR

Make nvcf-cli task get honor its secret-name opt-in by sending
includeSecrets=false when the flag is not set.

Additional Details

The CLI defaults --include-secrets to false, but Client.GetTask previously
omitted the query parameter for that value. The NVCT controllers default an
omitted includeSecrets parameter to true, so a normal task get request
could include secret names without an opt-in.

This change always serializes the caller's boolean choice. The existing client
test now verifies both includeSecrets=false and includeSecrets=true at the
HTTP request boundary.

The API returns secret names, not secret values. The command and flag surface
are unchanged, so no documentation migration or operator action is needed.
There are no dependency, license, or NOTICE changes.

For the Reviewer

Please review the query construction and the two table-driven cases in
internal/client. This PR does not change the server default or the response
shape.

PR #457 changes cmd/task.go; this PR deliberately stays in the two
internal/client files to avoid overlap.

For QA

QA needed: No.

Local validation:

• go test ./internal/client -run '^TestGetTaskWithSecrets$' -count=1
• go test ./internal/client -count=1
• go test -race ./internal/client -count=1
• go vet ./...
• bazel test --remote_cache= //src/clis/nvcf-cli/internal/client:client_test --test_output=errors
• bazel test --remote_cache= --nocache_test_results //src/clis/nvcf-cli/... --test_output=errors (20/20 test targets passed)
• bazel build --remote_cache= //src/clis/nvcf-cli:nvcf-cli
• git diff --check

Issues

Fixes #460

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• Bug Fixes
  • Task retrieval requests now explicitly indicate whether secret names should be included.
  • Improved consistency when fetching tasks without requesting secret information.
  • Reduced ambiguity in task responses by ensuring secret-related preferences are communicated for every request.
  • Existing behavior remains unchanged when secret information is requested.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4c7ff533-646b-4794-849f-a4a14c3aa39e

📥 Commits

Reviewing files that changed from the base of the PR and between 7cde8df and 65e77b0.

📒 Files selected for processing (2)

• src/clis/nvcf-cli/internal/client/tasks.go
• src/clis/nvcf-cli/internal/client/tasks_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• src/clis/nvcf-cli/internal/client/tasks_test.go
• src/clis/nvcf-cli/internal/client/tasks.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

Client.GetTask now always sends the includeSecrets query parameter with its boolean value. The regression test updates the no-flag case to expect includeSecrets=false.

Changes

Task secret selection

Layer / File(s)	Summary
Serialize and test includeSecrets src/clis/nvcf-cli/internal/client/tasks.go, src/clis/nvcf-cli/internal/client/tasks_test.go	GetTask always includes the boolean query parameter, and the test verifies the explicit false value when secrets are not requested.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 65e77

The CLI now explicitly sends the caller’s secret opt-in choice, preventing unintended inclusion of secret names when the flag is omitted. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: mikeyrcamp

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title uses the required Conventional Commits format, includes the required scope for a fix, and accurately describes the bug fix.
Linked Issues check	✅ Passed	The changes satisfy issue #460 by always serializing includeSecrets as false or true and adding regression coverage for both values.
Out of Scope Changes check	✅ Passed	All changes are limited to Client.GetTask behavior, its related comment, and regression tests required by issue #460.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.