Ignore secrets in stub run

modules/nextflow/src/main/groovy/nextflow/executor/BashWrapperBuilder.groovy

@@ -117,7 +117,7 @@ class BashWrapperBuilder {
     private BashTemplateEngine engine = new BashTemplateEngine()
 
     BashWrapperBuilder( TaskRun task ) {
-        this(new TaskBean(task))
+        this(task.toTaskBean())
     }
 
     BashWrapperBuilder( TaskBean bean, ScriptFileCopyStrategy strategy = null ) {

modules/nextflow/src/main/groovy/nextflow/processor/TaskBean.groovy

@@ -123,6 +123,10 @@ class TaskBean implements Serializable, Cloneable {
     }
 
     TaskBean(TaskRun task) {
+        this(task, false)
+    }
+
+    TaskBean(TaskRun task, boolean stubRun) {
 
         this.name = task.name
 
@@ -154,9 +158,10 @@ class TaskBean implements Serializable, Cloneable {
         this.containerEnabled = task.isContainerEnabled()
         this.containerOptions = task.config.getContainerOptions()
         this.containerPlatform = task.getContainerPlatform()
+
         // secret management
         this.secretNative = task.isSecretNative()
-        this.secretNames = task.config.getSecret()
+        this.secretNames = stubRun ? task.config.getSecret() : null
 
         // stats
         this.outputEnvNames = task.getOutputEnvNames()

modules/nextflow/src/main/groovy/nextflow/processor/TaskRun.groovy

@@ -984,7 +984,7 @@ class TaskRun implements Cloneable {
     }
 
     TaskBean toTaskBean() {
-        return new TaskBean(this)
+        return new TaskBean(this, processor.session.stubRun)
     }
 
     CondaConfig getCondaConfig() {