fix(build): keep Forgejo credentials out of bootstrap logs #119
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "agent/atlas-build-credentials-20260912"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The authenticated build bootstraps construct a credential-bearing clone URL under bash tracing, exposing the shared Forgejo token in init-container logs.
Use an ephemeral GIT_ASKPASS helper in all nine authenticated build and validation manifests, keep repository URLs free of credentials, disable tracing during helper setup, clear inherited Git/HTTP trace variables, and remove the helper on exit. Add a required CI test that executes each actual clone block with synthetic credentials under tracing: 54 success, shallow-clone refusal and total-failure cases under bash and sh verify authentication, clean output, failure status and cleanup.
Validation: all 54 cases and make lint pass; git diff --check passes. No C++ changes. The operations note records the exposure without secrets and requires coordinated rotation of the shared credential plus verification of a new bootstrap. Existing immutable jobs and original logs are not remediated by this source change; rotation remains open.
The credential matches twelve Opaque Kubernetes secrets across ten namespaces, including Flux and shared builders/receivers. That read-only comparison retained only names/keys/UIDs. Other consumers and coordinated rotation remain unqualified.