From 8cd0d4dd57a0618ead4be48413dda4660206dc0a Mon Sep 17 00:00:00 2001
From: Emil Simeonov <emil@theliberatededge.org>
Date: Fri, 18 Sep 2026 13:10:04 +0200
Subject: [PATCH] fix: redact secret env values in stall diagnostics inspect
 output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

docker inspect captures the container Env block, which for CI job
containers carries CI_GITEA_API_TOKEN and similar secrets — the diag
bundle must not become a secret artifact (OBL-INFRA-548 S02).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .../roles/gitea_runner/templates/runner-healthcheck.sh.j2   | 6 +++++-
 docs/specs/GRM-170.md                                       | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/ansible/roles/gitea_runner/templates/runner-healthcheck.sh.j2 b/ansible/roles/gitea_runner/templates/runner-healthcheck.sh.j2
index c53fdeb..a8d728d 100644
--- a/ansible/roles/gitea_runner/templates/runner-healthcheck.sh.j2
+++ b/ansible/roles/gitea_runner/templates/runner-healthcheck.sh.j2
@@ -57,7 +57,11 @@ now_epoch=$(date +%s)
             echo "=== stall diagnostics for $cname ($cid), age ${age_min}m ==="
             echo "--- exec probe: TIMEOUT (>10s) ---"
             echo "--- docker inspect ---"
-            timeout 15 docker inspect "$cid" 2>/dev/null
+            # Implements: REQ-3 — full inspect, but redact the Env block:
+            # job containers carry CI tokens in env vars; the bundle must
+            # not become a secret-material artifact.
+            timeout 15 docker inspect "$cid" 2>/dev/null \
+                | sed -E 's/("[^"]*(TOKEN|PASSWORD|SECRET|KEY)[^=]*=)[^",]*/\1<redacted>/Ig'
             echo "--- docker top ---"
             timeout 15 docker top "$cid" 2>/dev/null
             echo "--- docker stats --no-stream ---"
diff --git a/docs/specs/GRM-170.md b/docs/specs/GRM-170.md
index 6f573a4..42b643f 100644
--- a/docs/specs/GRM-170.md
+++ b/docs/specs/GRM-170.md
@@ -36,7 +36,11 @@ because GNU date rejects `+0000 UTC` together. The age gate then
 compares real minutes.
 
 REQ-3: Remove the `head -200` truncation on `docker inspect` output so
-the full State block is captured in the diagnostics bundle.
+the full State block is captured — but pipe through a `sed` filter that
+redacts the value of any env entry whose name contains TOKEN, PASSWORD,
+SECRET, or KEY. Job containers carry CI tokens in their Env block; the
+diagnostics bundle must not become a secret-material artifact
+(OBL-INFRA-548 S02).
 
 REQ-4: Diagnostics-only constraint unchanged — no kills, no restarts.