[Backport] Pipeline upload: look for secrets within trigger step build.env

[DrJosh9000]

Copy of #4116 description below. I'm not fully decided whether this backport is worth it.

---

Description

Trigger steps can contain env blocks too: under build. In pipeline upload, include these in the secret search.

Context

Buildsworth outputted some tokens upon the v4 branch: #3807 (comment)

Testing

• Tests have run locally (with go test ./...). Buildkite employees may check this if the pipeline has run automatically.
• Code is formatted (with go tool gofumpt -extra -w .)

Disclosures / Credits

I happen to know how this works.

[buildsworth-bk-app]

No issues found in this pass. This changes pipeline-upload secret detection, so I’m leaving final approval to a human reviewer. The agent CI check is still pending.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 12440, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. To let it approve, grant L2 approval by mentioning @buildsworth-bk (see L2 approval grant):

• L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
• L2 — Standard risk (new UI, additive API fields, refactors). Approved only with an L2 grant; otherwise comment-only.
• L3 — High risk (auth, migrations, payments, secrets, perf-critical paths). Human review always required.