fix: expandConfigStrings recurse into nested []any slices

engine.go

@@ -992,15 +992,25 @@ func expandConfigStrings(resolver *secrets.MultiResolver, cfg map[string]any) {
 		case map[string]any:
 			expandConfigStrings(resolver, val)
 		case []any:
-			for i, item := range val {
-				if s, ok := item.(string); ok {
-					if expanded, err := resolver.Expand(ctx, s); err == nil {
-						val[i] = expanded
-					}
-				} else if m, ok := item.(map[string]any); ok {
-					expandConfigStrings(resolver, m)
-				}
+			expandConfigSlice(resolver, val)
+		}
+	}
+}
+
+// expandConfigSlice expands ${...} placeholders in a slice, recursing into nested
+// maps and slices to support arbitrary nesting depth.
+func expandConfigSlice(resolver *secrets.MultiResolver, items []any) {
+	ctx := context.Background()
+	for i, item := range items {
+		switch v := item.(type) {
+		case string:
+			if expanded, err := resolver.Expand(ctx, v); err == nil {
+				items[i] = expanded
 			}
+		case map[string]any:
+			expandConfigStrings(resolver, v)
+		case []any:
+			expandConfigSlice(resolver, v)
 		}
 	}
 }

engine_secrets_test.go

@@ -195,6 +195,28 @@ func TestExpandConfigStrings_DeeplyNestedArrayOfMaps(t *testing.T) {
 	}
 }
 
+func TestExpandConfigStrings_NestedArrayOfArrays(t *testing.T) {
+	t.Setenv("CLIENT_ID", "test1")
+
+	resolver := secrets.NewMultiResolver()
+	cfg := map[string]any{
+		"roleAssignments": []any{
+			[]any{"${CLIENT_ID}", "api_client"},
+		},
+	}
+
+	expandConfigStrings(resolver, cfg)
+
+	assignments := cfg["roleAssignments"].([]any)
+	inner := assignments[0].([]any)
+	if inner[0] != "test1" {
+		t.Errorf("expected 'test1', got %v", inner[0])
+	}
+	if inner[1] != "api_client" {
+		t.Errorf("expected 'api_client', got %v", inner[1])
+	}
+}
+
 func TestExpandConfigStrings_UnresolvablePreserved(t *testing.T) {
 	resolver := secrets.NewMultiResolver()
 	cfg := map[string]any{