Auto stash before checking out "origin/main"

src/modules/Elsa.Secrets/Providers/SecretExpressionDescriptorProvider.cs

@@ -38,7 +38,36 @@ public class SecretExpressionDescriptorProvider : IExpressionDescriptorProvider
         if (valueElement.ValueKind is JsonValueKind.Undefined or JsonValueKind.Null)
             return new Expression(SecretExpression.TypeName, null);
 
-        var reference = valueElement.Deserialize<SecretReference>(context.Options);
+        var reference = DeserializeReference(valueElement, context.Options);
         return new Expression(SecretExpression.TypeName, reference);
     }
+
+    private static SecretReference? DeserializeReference(JsonElement valueElement, JsonSerializerOptions options)
+    {
+        try
+        {
+            return valueElement.ValueKind switch
+            {
+                JsonValueKind.Object => valueElement.Deserialize<SecretReference>(options),
+                JsonValueKind.String => DeserializeStringReference(valueElement.GetString(), options),
+                _ => null
+            };
+        }
+        catch (JsonException)
+        {
+            return null;
+        }
+    }
+
+    private static SecretReference? DeserializeStringReference(string? value, JsonSerializerOptions options)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+            return null;
+
+        var trimmedValue = value.Trim();
+        if (trimmedValue.StartsWith('{'))
+            return JsonSerializer.Deserialize<SecretReference>(trimmedValue, options);
+
+        return new SecretReference(trimmedValue);
+    }
 }

test/unit/Elsa.Secrets.UnitTests/SecretExpressionTests.cs

@@ -96,6 +96,42 @@ public class SecretExpressionTests
         Assert.Equal(new SecretReference("api:key", SecretTypeNames.Text, "production"), deserializedReference);
     }
 
+    [Fact]
+    public void SecretExpression_DeserializesEmptyStringAsNullReference()
+    {
+        var options = CreateSerializerOptions();
+        const string json = """{"type":"Secret","value":""}""";
+
+        var expression = JsonSerializer.Deserialize<Expression>(json, options)!;
+
+        Assert.Equal(SecretExpression.TypeName, expression.Type);
+        Assert.Null(expression.Value);
+    }
+
+    [Fact]
+    public void SecretExpression_DeserializesStringAsSecretName()
+    {
+        var options = CreateSerializerOptions();
+        const string json = """{"type":"Secret","value":"api:key"}""";
+
+        var expression = JsonSerializer.Deserialize<Expression>(json, options)!;
+
+        var reference = Assert.IsType<SecretReference>(expression.Value);
+        Assert.Equal(new SecretReference("api:key"), reference);
+    }
+
+    [Fact]
+    public void SecretExpression_DeserializesStringifiedSecretReference()
+    {
+        var options = CreateSerializerOptions();
+        const string json = """{"type":"Secret","value":"{\"name\":\"api:key\",\"typeName\":\"text\",\"scope\":\"production\"}"}""";
+
+        var expression = JsonSerializer.Deserialize<Expression>(json, options)!;
+
+        var reference = Assert.IsType<SecretReference>(expression.Value);
+        Assert.Equal(new SecretReference("api:key", SecretTypeNames.Text, "production"), reference);
+    }
+
     [Fact]
     public void WorkflowInputJson_StoresSecretReferenceNotSecretValue()
     {