#94 CI logs publish absolute builder paths
What
CI step logs are published verbatim and include absolute builder paths, e.g.:
Checking hu13 v0.1.0 (~/src/code/gl0w-w0rld/hu13)
Finished `dev` profile ...
Reproduced
/ci/index.html → 02_test.sh.log pre.
Impact
On a public deployment this leaks the builder’s home directory/username and local layout. Not a secret, but avoidable.
Fix
Redact the repo root (and its parent if needed) from captured logs at build time, e.g. replace the canonical repo path with <repo> and $HOME with ~. Keep logs otherwise byte-faithful and escaped. Test with a log containing the absolute path.
Comments (0)
No comments yet.