[camielvs]

Description

A run looks up its secrets in the account of whoever created it, so a run that uses a team's secrets has to be created as that team. Once it is, the backend only lets the run's creator change it. These methods now take an optional team id and send the impersonation header when given one. Every caller still passes none, so nothing changes yet.

• submitPipelineRun takes teamId and passes it to createPipelineRun.
• saveRunAnnotations and updateRunAnnotation take it too. The notes and tags written right after submit are separate requests. Without the header they would be refused for a run the team created.
• cancelPipelineRun takes it, so a run the team created can be cancelled.
• useTeamForRunAnnotations resolves the team of the projects a run is filed under. The same rule covers a run about to be submitted (the annotations it will carry) and a run already stored. So a rerun or cancel from a run page outside any project still finds the team.
• referencedSecretNames and missingSecretNames find the secrets a run needs and which of them an account lacks, for a check before submit. A secret reference holds only a name. Without this check, a run submitted from the wrong context would fail at launch, or quietly use a same-named secret from another account.

Related Issue and Pull requests

• Stacked on feat(secrets): scope secret storage to a team #2928.
• The UI PRs that wire these into the secrets screen, the submitters and the run page follow.

Type of Change

• New feature

Line Breakdown

Category	Added	Removed
Production code	60	2
Tests	277	1
Total	337	3

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Screenshots (if applicable)

None. There's no UI change.

Test Instructions

pnpm vitest run src/utils/submitPipeline.test.ts src/services/pipelineRunService.test.ts src/components/shared/Submitters/Tangle/saveRunAnnotations.test.ts src/components/shared/SecretsManagement/secretReferences.test.ts src/services/teams/useTeamForRunAnnotations.test.ts

To check by hand that nothing regressed:

1. Submit a run.
2. Add a note to it.
3. Cancel it.

All three should behave as on master.

Additional Comments

• The existing submitPipeline assertions gained a trailing undefined for the new teamId argument. None of their expectations changed.
• Known follow-up for the cancel UI PR: cancelPipelineRun and updateRunAnnotation go through fetchWithErrorHandling, which drops the response's detail. A refused impersonation there surfaces as a generic error until that's handled.

🤖 Generated with Claude Code

[github-actions]

🎩 Preview

A preview build has been created at: cvs/team-run-methods/96d0264