Copilot commented on code in PR #3719:
URL:
https://github.com/apache/incubator-kie-tools/pull/3719#discussion_r3813249891
##########
packages/image-builder/src/bin.ts:
##########
@@ -337,6 +338,22 @@ Also useful to aid on developing images and pushing them
to Kubernetes/OpenShift
return evaluedBuildArgs;
},
},
+ secret: {
+ demandOption: false,
+ describe: "Secrets to expose to the build in the format
'id=<id>,src=<path>' (Can be used multiple times)",
+ type: "array",
+ default: [],
+ coerce: (secrets: string[]) => {
+ const regex = new RegExp(/(id=.*)+/);
+ const results = secrets.map((s: string) =>
regex.test(s.toString().trim()));
+ if (!results.every(Boolean)) {
+ throw new Error(
+ `ERROR! --secret: Invalid secret supplied ("${secrets.join("
")}"). Use the format 'id=<id>,src=<path>'`
+ );
+ }
+ return secrets.map((s: string) => s.toString().trim());
+ },
Review Comment:
The validation regex only checks for the presence of "id=" anywhere in the
string, so malformed inputs like "id=foo" (missing src), "xid=foo,src=/p", or
"id=" will pass. Consider parsing the secret spec as comma-separated key/value
pairs and enforcing required keys (e.g., id + src, and/or id + env if
supported), non-empty values, and rejecting unknown keys.
##########
packages/image-builder/src/bin.ts:
##########
@@ -366,6 +383,7 @@ Also useful to aid on developing images and pushing them to
Kubernetes/OpenShift
- containerfile: ${args.containerfile}
- context: ${args.context}
- buildArgs: ${args.buildArg.join(" ")}
+ - secret: ${args.secret?.join(" ") ?? " - "}
Review Comment:
The CLI logs the full --secret arguments. Depending on usage, this can leak
sensitive information (e.g., file paths, or potentially inline secret material
if a future format is supported). Recommend redacting values in logs (e.g.,
print only secret ids or print a count), while still forwarding the full value
to the build command.
##########
packages/image-builder/src/bin.ts:
##########
@@ -438,6 +457,7 @@ Also useful to aid on developing images and pushing them to
Kubernetes/OpenShift
- containerfile: ${args.containerfile}
- context: ${args.context}
- buildArg: ${args.buildArg?.join(" ") ?? " - "}
+ - secret: ${args.secret?.join(" ") ?? " - "}
Review Comment:
The CLI logs the full --secret arguments. Depending on usage, this can leak
sensitive information (e.g., file paths, or potentially inline secret material
if a future format is supported). Recommend redacting values in logs (e.g.,
print only secret ids or print a count), while still forwarding the full value
to the build command.
##########
packages/image-builder/src/bin.ts:
##########
@@ -395,6 +413,7 @@ Also useful to aid on developing images and pushing them to
Kubernetes/OpenShift
- containerfile: ${args.containerfile}
- context: ${args.context}
- buildArg: ${args.buildArg?.join(" ") ?? " - "}
+ - secret: ${args.secret?.join(" ") ?? " - "}
Review Comment:
The CLI logs the full --secret arguments. Depending on usage, this can leak
sensitive information (e.g., file paths, or potentially inline secret material
if a future format is supported). Recommend redacting values in logs (e.g.,
print only secret ids or print a count), while still forwarding the full value
to the build command.
##########
packages/image-builder/src/bin.ts:
##########
@@ -337,6 +338,22 @@ Also useful to aid on developing images and pushing them
to Kubernetes/OpenShift
return evaluedBuildArgs;
},
},
+ secret: {
+ demandOption: false,
+ describe: "Secrets to expose to the build in the format
'id=<id>,src=<path>' (Can be used multiple times)",
Review Comment:
The PR title/linked issue mentions accepting "secret values", but the CLI
help/validation only documents and (intends to) accept the src=<path> form. If
the goal is to support passing secret values via environment (Buildx supports
id=<id>,env=<VAR>), update the help text + validation accordingly; otherwise
consider adjusting the PR title/description to match the implemented src-based
behavior.
##########
packages/image-builder/src/bin.ts:
##########
@@ -480,6 +500,7 @@ Also useful to aid on developing images and pushing them to
Kubernetes/OpenShift
- containerfile: ${args.containerfile}
- context: ${args.context}
- buildArg: ${args.buildArg?.join(" ") ?? " - "}
+ - secret: ${args.secret?.join(" ") ?? " - "}
Review Comment:
The CLI logs the full --secret arguments. Depending on usage, this can leak
sensitive information (e.g., file paths, or potentially inline secret material
if a future format is supported). Recommend redacting values in logs (e.g.,
print only secret ids or print a count), while still forwarding the full value
to the build command.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
