Use skip-redaction option for crcr-report (#56532)
Signed-off-by: khluu <khluu000@gmail.com> Co-authored-by: khluu <khluu000@gmail.com> Co-authored-by: Codex <noreply@openai.com>
Andrey Talman committed
Sep 16, 2026 at 22:01 UTC
062f81d8ef165ccef83df3da877af5669d852509
1 file changed
+6
-11
.buildkite/scripts/crcr-report.sh
+6
-11
@@ -40,8 +40,7 @@ fi
40
TOKEN_SECRET_KEY="${CRCR_BUILDKITE_TOKEN_SECRET_KEY:-CRCR_BUILDKITE_API_TOKEN}"
41
BK_TOKEN="${BUILDKITE_API_TOKEN:-}"
42
if [[ -z "${BK_TOKEN}" ]]; then
43
- # Not in the job environment, so read it from a Buildkite secret. The agent
44
- # redacts values fetched this way from the log.
43
+ # Not in the job environment, so read it from a Buildkite secret.
44
#
45
# Report why a lookup failed. Swallowing stderr made a missing secret, a
46
# denied policy and an unusable agent indistinguishable, all surfacing as the
@@ -50,14 +49,9 @@ if [[ -z "${BK_TOKEN}" ]]; then
49
echo "buildkite-agent is not on PATH; cannot read secret '${TOKEN_SECRET_KEY}'"
50
else
51
secret_err="$(mktemp)"
53
- # Deliberately not passing --skip-redaction. On the deployed agent
54
- # (v3.73.1) the flag cannot help: secret_get.go creates the Job API
55
- # client unconditionally and only checks SkipRedaction afterwards, so
56
- # under the docker plugin -- which does not expose the Job API socket to
57
- # the container -- it fails before the flag is read. That ordering was
58
- # only fixed in v3.107.0. Skipping redaction would also stop the token
59
- # being registered with the log redactor, for no gain here.
60
- if BK_TOKEN="$(buildkite-agent secret get "${TOKEN_SECRET_KEY}" 2>"${secret_err}")"; then
52
+ # Requires agent >= 3.107.0: the Docker plugin does not mount the Job API
53
+ # socket needed for redaction. Capture the value without logging it.
54
+ if BK_TOKEN="$(buildkite-agent secret get --skip-redaction "${TOKEN_SECRET_KEY}" 2>"${secret_err}")"; then
55
if [[ -z "${BK_TOKEN}" ]]; then
56
echo "secret '${TOKEN_SECRET_KEY}' resolved but is empty"
57
fi
@@ -77,7 +71,8 @@ if [[ -z "${BK_TOKEN}" ]]; then
71
fi
72
73
AUDIENCE="pytorch-cross-repo-ci-relay"
80
-OIDC_TOKEN="$(buildkite-agent oidc request-token --audience "${AUDIENCE}" 2>/dev/null)"
74
+# OIDC redaction also requires the unavailable Job API socket.
75
+OIDC_TOKEN="$(buildkite-agent oidc request-token --skip-redaction --audience "${AUDIENCE}" 2>/dev/null)"
76
if [[ -z "${OIDC_TOKEN}" ]]; then
77
echo "could not mint a Buildkite OIDC token -- skipping report"
78
exit 0