fix: simplify runtime output emission

Author: fqjony

docs/config.md

@@ -81,11 +81,7 @@ docker run --rm \
 
 ## Runtime Output
 
-By default the worker does not print runtime config details or write output files. The entrypoint logs a short hint that output can be enabled.
-
-Set `WORKER_OUTPUT_FILE` when a deployment or workflow needs redacted runtime config evidence. The worker writes JSON runtime metadata to that path after `worker.yaml`, deployment environment overrides, and secret references have been applied.
-
-Set `WORKER_OUTPUT_LOG=true` to also emit the same JSON to container logs as a single minified line prefixed with `WORKER_RUNTIME_OUTPUT_JSON=`. This is useful for Kubernetes or workflow systems where the next step reads container logs instead of a mounted file.
+By default the worker does not print runtime config details. The entrypoint logs a short hint that output can be enabled.
 
 Set `WORKER_OUTPUT_STDOUT=true` when a workflow should capture only the runtime JSON from stdout. In this mode the entrypoint sends setup logs to stderr, writes the redacted runtime JSON to stdout, and exits before starting the process manager:
 
@@ -95,6 +91,8 @@ docker run --rm \
   usabilitydynamics/udx-worker:latest > runtime-output/runtime.json
 ```
 
+Set `WORKER_OUTPUT_LOG=true` to also emit the same JSON to container logs as a single minified line prefixed with `WORKER_RUNTIME_OUTPUT_JSON=`. This is useful for Kubernetes or workflow systems where the next step reads container logs from a normal-running container.
+
 The output contains:
 
 - `env`: resolved non-secret environment variables.

lib/runtime_output.sh

@@ -81,18 +81,29 @@ build_runtime_redacted_json() {
     local config_json="$1"
     local names name json
 
-    if [[ ! -f "$WORKER_ENV_FILE" ]]; then
-        log_error "Runtime output" "Environment file not found: $WORKER_ENV_FILE"
-        return 1
+    json=$(echo "$config_json" | jq -c --arg pattern "^(${SUPPORTED_SECRET_PROVIDERS})/.+/.+" '
+        [
+            (.config.secrets // {} | keys[]?),
+            (.config.env // {} | to_entries[]? | select(((.value // "") | tostring) | test($pattern)) | .key)
+        ]
+    ') || return 1
+
+    if [[ -f "$WORKER_ENV_FILE" ]]; then
+        names=$(grep "^export " "$WORKER_ENV_FILE" | cut -d'=' -f1 | cut -d' ' -f2)
+        while IFS= read -r name; do
+            if [[ -n "$name" ]] && is_runtime_output_redacted_name "$config_json" "$name"; then
+                json=$(echo "$json" | jq --arg name "$name" '. + [$name]') || return 1
+            fi
+        done <<< "$names"
     fi
 
-    names=$(grep "^export " "$WORKER_ENV_FILE" | cut -d'=' -f1 | cut -d' ' -f2)
-    json="[]"
-    while IFS= read -r name; do
-        if [[ -n "$name" ]] && is_runtime_output_redacted_name "$config_json" "$name"; then
-            json=$(echo "$json" | jq --arg name "$name" '. + [$name]') || return 1
-        fi
-    done <<< "$names"
+    if [[ -f "$WORKER_ENV_REDACTION_FILE" ]]; then
+        while IFS= read -r name; do
+            if [[ -n "$name" ]]; then
+                json=$(echo "$json" | jq --arg name "$name" '. + [$name]') || return 1
+            fi
+        done < "$WORKER_ENV_REDACTION_FILE"
+    fi
 
     echo "$json" | jq -S 'unique'
 }
@@ -140,8 +151,8 @@ emit_runtime_output_stdout() {
 emit_runtime_output() {
     local config_json runtime_json
 
-    if [[ -z "${WORKER_OUTPUT_FILE:-}" ]] && ! runtime_output_log_enabled && ! runtime_output_stdout_enabled; then
-        log_info "Runtime output disabled. Set WORKER_OUTPUT_FILE, WORKER_OUTPUT_LOG=true, or WORKER_OUTPUT_STDOUT=true to emit redacted JSON runtime config for workflow/deployment integrations."
+    if ! runtime_output_log_enabled && ! runtime_output_stdout_enabled; then
+        log_info "Runtime output disabled. Set WORKER_OUTPUT_STDOUT=true or WORKER_OUTPUT_LOG=true to emit redacted JSON runtime config for workflow/deployment integrations."
         return 0
     fi
 
@@ -151,13 +162,6 @@ emit_runtime_output() {
         return 1
     fi
 
-    if [[ -n "${WORKER_OUTPUT_FILE:-}" ]]; then
-        mkdir -p "$(dirname "$WORKER_OUTPUT_FILE")" || return 1
-        install -m 600 /dev/null "$WORKER_OUTPUT_FILE" || return 1
-        printf '%s\n' "$runtime_json" > "$WORKER_OUTPUT_FILE"
-        log_info "Runtime output written to $WORKER_OUTPUT_FILE"
-    fi
-
     if runtime_output_log_enabled; then
         emit_runtime_output_log "$runtime_json" || return 1
     fi

src/configs/worker.yaml

@@ -3,7 +3,6 @@ kind: workerConfig
 version: udx.io/worker-v1/config
 config:
   env:
-    WORKER_OUTPUT_FILE: ""
     WORKER_OUTPUT_LOG: "false"
     WORKER_OUTPUT_STDOUT: "false"
   secrets: {}

test/modules/25_runtime_output.sh

@@ -34,7 +34,8 @@ CONFIG_JSON='{
       "CONFIG_REF": "gcp/project-id/secret-name"
     },
     "secrets": {
-      "CONFIG_SECRET": "aws/secret-name/us-west-2"
+      "CONFIG_SECRET": "aws/secret-name/us-west-2",
+      "CONFIG_ONLY_SECRET": "aws/config-only/us-west-2"
     }
   }
 }'
@@ -58,7 +59,7 @@ if echo "$RUNTIME_OUTPUT" | jq -e '.env.CONFIG_SECRET or .env.CONFIG_REF or .env
     exit 1
 fi
 
-if ! echo "$RUNTIME_OUTPUT" | jq -e '.redacted == ["CONFIG_REF", "CONFIG_SECRET", "DEPLOYMENT_SECRET", "DEPLOYMENT_SECRET_TWO"]' >/dev/null; then
+if ! echo "$RUNTIME_OUTPUT" | jq -e '.redacted == ["CONFIG_ONLY_SECRET", "CONFIG_REF", "CONFIG_SECRET", "DEPLOYMENT_SECRET", "DEPLOYMENT_SECRET_TWO"]' >/dev/null; then
     print_error "runtime output redacted list is incorrect"
     exit 1
 fi