oblachno-oss/grm
3
0
Fork 0
Code Issues 33 Pull Requests Actions Packages Projects Releases 23 Wiki Activity

fix: redact secret env values in stall diagnostics inspect output
CI / validate (pull_request) Successful in 1m9s
Details
CI / molecule-tests (1) (pull_request) Successful in 5m23s
Details
CI / molecule-tests (3) (pull_request) Successful in 7m5s
Details
CI / molecule-tests (2) (pull_request) Successful in 7m27s
Details
CI / molecule-tests (4) (pull_request) Successful in 7m31s
Details
CI / auto-merge (pull_request) Successful in 7m50s
Details

Browse Source 
docker inspect captures the container Env block, which for CI job
containers carries CI_GITEA_API_TOKEN and similar secrets — the diag
bundle must not become a secret artifact (OBL-INFRA-548 S02).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
Emil Simeonov
2026-09-18 13:10:04 +02:00
co-authored by Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
parent a61075ebde
commit 8cd0d4dd57
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/specs/GRM-170.md
+5 -1
View File
@@ -36,7 +36,11 @@ because GNU date rejects `+0000 UTC` together. The age gate then
compares real minutes.
REQ-3: Remove the `head -200` truncation on `docker inspect` output so
the full State block is captured in the diagnostics bundle.
the full State block is captured — but pipe through a `sed` filter that
redacts the value of any env entry whose name contains TOKEN, PASSWORD,
SECRET, or KEY. Job containers carry CI tokens in their Env block; the
diagnostics bundle must not become a secret-material artifact
(OBL-INFRA-548 S02).
REQ-4: Diagnostics-only constraint unchanged — no kills, no restarts.