feat: add coder secret import for bulk secret files - #27534

PLAT-240

Docs preview

Check off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here.

• docs/reference/cli/secret.md
• docs/reference/cli/secret_import.md
• docs/user-guides/user-secrets.md

Documentation Check

Re-checked after the update. The push was a merge of origin/main into the branch; no new PR commits (6193568, 4d39fa2, 44eb9f4 are unchanged), so none of the items below were addressed yet. The merge did bring in feat: add enable/disable support for user secrets (#27537), which changes import behavior and adds two new items at the end.

The PR still ships docs alongside the code (docs/user-guides/user-secrets.md, generated CLI reference, docs/manifest.json), and the regenerated docs/reference/cli/secret.md subcommand table is consistent with the merged enable/disable commands. docs/reference/api/secrets.md needs no manual edits.

Updates Needed

• docs/user-guides/user-secrets.md - The new "Import multiple secrets from a file" examples state no expected output. The content guidelines require CLI examples to state what the user gets back. Show Imported 2 secrets. and the stderr warning (2 secrets imported without an environment variable name: ...).
• docs/user-guides/user-secrets.md - Document the accepted file shapes. codersdk.ParseSecretsFile only accepts a flat mapping of string values: JSON must be a single object with string values (nested objects/arrays rejected), YAML must be a single document mapping with string scalars, and numeric or boolean YAML values must be quoted (PORT: "8080"). Duplicate keys fail the parse. None of this is in the guide, and unquoted YAML scalars are the most likely first-attempt failure.
• docs/user-guides/user-secrets.md - Document the dotenv subset. Supported: KEY=VALUE, optional export prefix, full-line # comments, single-quoted literal values, double-quoted values with \n, \t, \r, \\, \" escapes. Not supported: $VAR/${VAR} expansion, inline comment stripping (PASS=abc#123 stores abc#123), and multiline values (use JSON or YAML for PEM keys or certs).
• docs/user-guides/user-secrets.md - Document the import-specific limits with exact values: max file size 1 MiB (codersdk.MaxSecretsFileBytes) and max 50 entries per file (MaxUserSecretsPerUserCount). Either add rows to the "Limits" table or state them in the import section.
• docs/user-guides/user-secrets.md - The "Limits" section says Coder enforces caps "when you create or update a secret". Import is a third path that enforces them, and an over-cap entry aborts the whole import.
• docs/user-guides/user-secrets.md - Clarify the collision behavior. "never overwrites existing secrets" reads as "skips keys that already exist"; the server returns 409 and rolls back the entire transaction, so a single colliding name or env name means nothing is imported. Say so explicitly.
• docs/user-guides/user-secrets.md - "Keys that are valid environment variable names are injected under the same name" is incomplete. Reserved names (PATH, CODER_*, and the rest of reservedEnvNames) look valid but are still imported without env injection. Mention reserved names alongside non-identifier keys such as MY-TOKEN.
• docs/user-guides/user-secrets.md - State which extensions the format inference recognizes (.env, .json, .yaml, .yml) and that anything else, including .env.local, requires --input-format. Right now "inferred from the file extension" gives no way to predict the .env.local failure.
• docs/user-guides/user-secrets.md - Import never sets a description or file target. Worth one sentence, since every other create path in the guide shows --description and --file.
• docs/user-guides/user-secrets.md - The dashboard section claims "The rest of this guide shows the equivalent CLI commands". Import has no dashboard equivalent, so that parity statement is now inaccurate.

New after the merge of #27537 (enable/disable)

• docs/user-guides/user-secrets.md - Post-merge, ParseSecretsFile sets Enabled = false for any key that cannot be env-injected, so those secrets land disabled, not merely target-less. The import section says only "other keys are imported without an environment variable target", which now understates it. State that such keys are imported disabled and that the fix is coder secret update <name> --env <ENV_NAME> (or --file) followed by coder secret enable <name>, and link the neighbouring "Create a disabled secret" / enable-disable sections.
• cli/secret.go (drives the generated docs/reference/cli/secret_import.md) - The command's Long text and the warnSecretsWithoutEnvName hint both predate feat: add enable/disable support for user secrets #27537: they say the keys are stored without an env name and imply coder secret update --env alone restores injection. They never mention the secret is disabled or that coder secret enable is required. Fix the strings in cli/secret.go and regenerate; do not hand-edit the generated reference page.

Automated review via Coder Agents

The last AI doc check calls out a bunch of docs being needed, but they are almost entirely added in this PR which is adding the corresponding UI element for bulk upload #26725