feat(secrets): add apify secrets check + fail-fast on array-shaped environmentVariables

[DaveHanns]

Summary

Two related issues currently make it easy to push an Actor whose @name secret references are silently broken, and there is no CLI command to check them before pushing:

1. No standalone way to verify secret references. Nothing checks that @name references in .actor/actor.json resolve to locally-added secrets until apify push is deep inside transformEnvToEnvVars, and even that check can be silenced with --allow-missing-secrets.

2. Array-shaped environmentVariables are silently accepted. environmentVariables is documented as a JSON object (key → value map), but a common mistake — especially when copy-pasting from the Apify API wire shape or from other tooling — is to write it as an array of { name, value } entries. The CLI accepts that shape without complaint and ships a build where every env-var value is the literal string [object Object].

This PR adds an apify secrets check preflight command and wires the shape check into apify push so both mistakes fail fast with actionable errors.

Reproducer for the silent-array bug

Given .actor/actor.json:

{
  "actorSpecification": 1,
  "name": "test-actor",
  "version": "0.0",
  "environmentVariables": [
    { "name": "MY_TOKEN", "value": "@mySecret" }
  ]
}

apify push today completes without any warning. On the platform, the build's env vars contain a single entry whose value at runtime is literally [object Object]. Tracing through src/lib/secrets.ts:

• transformEnvToEnvVars calls Object.keys(env) on the array, iterating '0', '1', ...
• For each numeric key, env[key] is an { name, value } object.
• isSecretKey({ name, value }) coerces the object to [object Object], which does not match ^@., so the "secret" branch is never taken.
• The whole object is passed through as envVars.push({ name: '0', value: {name, value} }).

Changes

• New apify secrets check command (src/commands/secrets/check.ts) — scans .actor/actor.json for every @name reference, verifies each resolves to a locally stored secret, and validates the shape of environmentVariables. Supports --json for scripting and --dir for pointing at another Actor directory. Exits non-zero on any failure.

• validateEnvironmentVariablesShape and findSecretReferences helpers in src/lib/secrets.ts. Both are used by the new command and by apify push's preflight. Rejects arrays, scalars, and objects with non-string values, and emits a diff-style error message that shows the exact fix.

• apify push preflight — the shape check now runs after useActorConfig and before any upload. The push fails fast with CommandExitCodes.InvalidActorJson, so the agent/user sees the error immediately instead of a broken deployed Actor.

• Unit tests for both new helpers, covering array / scalar / non-string-value failure modes and reference extraction.

Example error output

$ apify push
"environmentVariables" in .actor/actor.json must be a JSON object (key-value map), not an array.

Change it from:
  "environmentVariables": [{ "name": "MY_TOKEN", "value": "@mySecret" }]
to:
  "environmentVariables": { "MY_TOKEN": "@mySecret" }

See https://docs.apify.com/platform/actors/development/actor-definition/actor-json#fields for the expected schema.

$ apify secrets check
The following secrets referenced in .actor/actor.json are missing from local storage:
  - userApiToken  (referenced by environmentVariables.ACTOR_USER_API_TOKEN)

Add them by running:
  apify secrets add userApiToken <SECRET_VALUE>

Test plan

• pnpm test:local — unit tests for validateEnvironmentVariablesShape and findSecretReferences all pass (15/15 in test/local/lib/secrets.test.ts).
• tsc --noEmit — clean.
• oxlint --type-aware on all touched files — clean.
• oxfmt --check on all touched files — clean.
• Manual: create an Actor with array-shaped environmentVariables and run apify push — should fail with the object-vs-array error before any upload.
• Manual: create an Actor with "environmentVariables": { "TOKEN": "@doesNotExist" } and no local secret for doesNotExist, then run apify secrets check — should exit non-zero and print the "add" command.
• Manual: with all @name references present locally, apify secrets check should print the green "all N secret reference(s) resolve" message.

Surfaced during an evaluation of Apify surfaces for agent-driven Actor development.