Repository navigation
Keep ${VAR} references when stripping generated secrets from templates - #285
Merged
Merged
Conversation
strip_generated_field_values blanks every value of a generated/provided
field before a template is stored, so the author's secrets never ship. It
also blanked values that only name another variable, like
AWS_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}. That reference is how one
generated secret feeds two services; without it each key is regenerated
on its own and the app and MinIO get different values.
A value that is exactly ${NAME} or $NAME is now kept, in all five shapes
the stripper handles (JSON map, JSON key/value pair, JSON and YAML K=V
lists, YAML map). ${NAME:-default} is still blanked: the default can be
the secret itself.
Tests: helpers::redact strip_*_keeps_references_to_other_variables (fail
before the fix). lib 2240 passed, marketplace and field-policy integration
64 passed, BDD 334 scenarios passed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012TKZy6f5shPzM9WLdswH6f
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
strip_generated_field_values blanks every value of a generated/provided field before a template is stored, so the author's secrets never ship. It also blanked values that only name another variable, like AWS_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}. That reference is how one generated secret feeds two services; without it each key is regenerated on its own and the app and MinIO get different values.
A value that is exactly ${NAME} or$NAME is now kept, in all five shapes the stripper handles (JSON map, JSON key/value pair, JSON and YAML K=V lists, YAML map). $ {NAME:-default} is still blanked: the default can be the secret itself.
Tests: helpers::redact strip_*_keeps_references_to_other_variables (fail before the fix). lib 2240 passed, marketplace and field-policy integration 64 passed, BDD 334 scenarios passed.
Claude-Session: https://claude.ai/code/session_012TKZy6f5shPzM9WLdswH6f