Global credentials

[josephjclark]

Short Description

This PR adds the capability for what I'm calling "global credentials" in the runtime.

What that means is you can specify a credential on root of the workflow JSON, and it'll automatically be grafted into every step in state.configuration.

This feels like a logical and intuitive feature - but it's also a great use-case for collections. It provides a really neat mechanism for the worker to add system-level credentials.

I mean the alternative is to support credentials as an array, which is sort of covered in #802. But this is gnarly change and too big for what I was looking for with collections.

Fixes #

Implementation Details

If we detect possible use of the collections API in job code (literally just the string collections.), the worker create a global credential on the execution plan, adding collections_token and collections_endpoint. The endpoint is set to the lightning base URL used by the worker.

AI Usage

Please disclose how you've used AI in this work (it's cool, we just want to know!):

• Code generation (copilot but not intellisense)
• Learning or fact checking
• Strategy / design
• Optimisation / refactoring
• Translation / spellchecking / doc gen
• Other
• I have not used AI

You can read more details in our Responsible AI Policy