From 1fcfa45e22ade397f8a4c948d8860ceb35375b00 Mon Sep 17 00:00:00 2001 From: Dotta Date: Wed, 2 Sep 2026 19:24:57 -0500 Subject: [PATCH] ci(runner): reveal sanitized descriptor probe failure --- .github/workflows/runner-full-stack-e2e.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/runner-full-stack-e2e.yml b/.github/workflows/runner-full-stack-e2e.yml index b82f2c2605e..1be9745ab35 100644 --- a/.github/workflows/runner-full-stack-e2e.yml +++ b/.github/workflows/runner-full-stack-e2e.yml @@ -353,6 +353,7 @@ jobs: python3 <<'PY' import json import os + import re import select import shutil import subprocess @@ -446,6 +447,23 @@ jobs: ) if opened.get("ok") is not True: message = str(opened.get("error", {}).get("message", "")) + safe_message = message + for key, value in environment.items(): + if value and any( + marker in key.upper() + for marker in ("KEY", "TOKEN", "SECRET", "PASSWORD") + ): + safe_message = safe_message.replace(value, "[ENV_SECRET]") + safe_message = re.sub( + r"(?i)(bearer\s+|sk-)[A-Za-z0-9._-]+", + r"\1[REDACTED]", + safe_message, + ) + safe_message = re.sub( + r"/(?:home|tmp)/[^\s'\"]+", + "[PATH]", + safe_message, + ) probes = [ "ENOENT", "EACCES", "EPERM", "memfd", "deleted", "lstat", "guardian", "ownership", "handshake", "credential", "fence", @@ -458,6 +476,7 @@ jobs: "messageDigest": __import__("hashlib").sha256( message.encode("utf8") ).hexdigest(), + "safeMessage": safe_message[:2_000], "classifiers": [ probe for probe in probes if probe.lower() in message.lower() ],