buildkite / buildkite/agent

Do not spam logs about skipped env var redactions for known false positives

Open
#2,020 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.1k
Forks
378
Avg merge
2d 6h
Merged PRs (30d)
74

Description

**Is your feature request related to a problem? Please describe.**
To be overly cautious, we added \*KEY\* to our redacted-vars config. Soon CI job logs were spammed with:
> ⚠️ Warning: Value of BUILDKITE_SSH_KEYSCAN below minimum length (6 bytes) and will not be redacted

That env var will [only ever be true or false and is immutable](https://buildkite.com/docs/pipelines/environment-variables#BUILDKITE_SSH_KEYSCAN).

But carving out a bunch of possible patterns for redacted-vars is not a good experience.

**Describe the solution you'd like**
Instead, the agent should know if an env var is known and will never contain actual secret values and never spam warning messages in logs about them.

**Describe alternatives you've considered**
Constantly tuning redacted-vars patterns to workaround every single possibility.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.