fix: redact S3 creds in --cache-to/--cache-from #6

Merged

stephen merged 1 commit from fix/redact-cache-creds into main

2026-06-30 21:02:43 +00:00

stephen commented

2026-06-30 20:59:54 +00:00

Owner

scripts/build.sh redacted_args() masked build-arg/label/secret/ssh but not --cache-to/--cache-from, which carry inline secret_access_key= / S3 creds, so they leaked into the build log. Now redacts secret values inside cache specs. Test asserts a cache spec containing secret_access_key is masked.

Backlog #12.

stephen added 1 commit

2026-06-30 20:59:54 +00:00

Redact inline secrets in --cache-to/--cache-from specs

test / unit (pull_request) Successful in 5s

Details

test / e2e (pull_request) Successful in 4s

Details

ef6be34a25

redacted_args() masked --build-arg/--label/--secret/--ssh but passed
--cache-to and --cache-from through verbatim. S3 and azblob cache
exporters accept inline credentials (access_key_id, secret_access_key,
session_token) in the comma-separated spec, so those values leaked into
the printed build command.

Mask the credential values inside the cache spec while keeping the
non-secret fields (type, region, bucket, ref, mode) readable. Add a test
asserting a cache spec carrying secret_access_key is redacted in the
logged command but still passed intact to docker.

stephen merged commit da149b1ce5 into main

2026-06-30 21:02:43 +00:00

stephen deleted branch fix/redact-cache-creds

2026-06-30 21:02:44 +00:00

stephen referenced this pull request from a commit

2026-06-30 21:02:44 +00:00

fix: redact S3 creds in --cache-to/--cache-from (#6)