Skip to content

fix(ci): prevent secrets in E2E artifacts#1825

Open
notgitika wants to merge 1 commit into
mainfrom
security/redact-e2e-artifacts
Open

fix(ci): prevent secrets in E2E artifacts#1825
notgitika wants to merge 1 commit into
mainfrom
security/redact-e2e-artifacts

Conversation

@notgitika

@notgitika notgitika commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Summary

  • suppress credential-shaped values and current secret environment values from Vitest console output
  • omit console streams from JUnit and sanitize failure details before artifact upload
  • block artifact upload unless the post-sanitization scan passes, including fail-closed handling for symbolic links

Validation

  • full unit suite: 5,984 passed
  • focused redaction tests: 5 passed
  • TypeScript typecheck, ESLint, Prettier, Secretlint, YAML parse, and git diff --check passed
  • synthetic report was rejected before sanitization and passed after sanitization
  • branch-dispatched E2E workflow passed GA, harness, sanitize, verify, and upload steps
  • both uploaded JUnit reports parsed successfully, contained no console streams, and passed an independent post-download scan

@notgitika
notgitika requested a review from a team July 23, 2026 23:00
@github-actions github-actions Bot added the size/m PR size: M label Jul 23, 2026
@github-actions github-actions Bot added agentcore-harness-reviewing AgentCore Harness review in progress and removed agentcore-harness-reviewing AgentCore Harness review in progress labels Jul 23, 2026
@notgitika notgitika changed the title fix(ci): prevent secrets in E2E test artifacts fix(ci): prevent secrets in E2E artifacts Jul 23, 2026
@agentcore-devx-automation agentcore-devx-automation Bot added the claude-security-reviewing Claude Code /security-review in progress label Jul 23, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Package Tarball

aws-agentcore-0.24.2.tgz

How to install

gh release download pr-1825-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.24.2.tgz

@agentcore-devx-automation

Copy link
Copy Markdown
Contributor

Claude Security Review: no high-confidence findings. (run)

@agentcore-devx-automation agentcore-devx-automation Bot removed the claude-security-reviewing Claude Code /security-review in progress label Jul 23, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Coverage Report

Status Category Percentage Covered / Total
🔵 Lines 40.31% 15049 / 37333
🔵 Statements 39.56% 16039 / 40535
🔵 Functions 34.42% 2567 / 7457
🔵 Branches 33.71% 10022 / 29728
Generated in workflow #4201 for commit 1be49d2 by the Vitest Coverage Report Action

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/m PR size: M

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant