From 958ae9b3652c8ea040b0d04eda02b4b2025438cb Mon Sep 17 00:00:00 2001 From: hermes Date: Mon, 9 Nov 2026 12:00:18 +1000 Subject: [PATCH] fix(ci): keep the credentials out of the process list Two small changes to the deploy job: - The registry password went through `-u armistace:$PASSWORD` on the curl command line, where it is visible in the process list for the duration of the request. It now goes through a curl config file on stdin instead. - The kubeconfig is written with mode 600 rather than the default, and is removed at the end of the job (with `if: always()`, so it is removed even if a later step fails). It is cluster-admin-equivalent, so it should not be readable by anything else on the runner. Verified: `curl --config -` against the registry returns the same digest as the `-u` form. --- .gitea/workflows/build_push.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.gitea/workflows/build_push.yml b/.gitea/workflows/build_push.yml index edbd23e..e1de732 100644 --- a/.gitea/workflows/build_push.yml +++ b/.gitea/workflows/build_push.yml @@ -114,7 +114,12 @@ jobs: - name: Create Kubeconfig run: | mkdir -p $HOME/.kube + # Written with restrictive permissions: the kubeconfig is + # cluster-admin-equivalent, so it should not be readable by + # anything else on the runner. + install -m 600 /dev/null $HOME/.kube/config echo "${{ secrets.KUBEC_CONFIG_BUILDX }}" > $HOME/.kube/config + chmod 600 $HOME/.kube/config - name: Install kubectl run: | @@ -171,6 +176,10 @@ jobs: exit 1 fi + - name: Remove the kubeconfig + if: always() + run: rm -f $HOME/.kube/config + - name: Smoke test the deployed app run: | # Check the app's own port from inside the pod, AND the Service in