[CI] Surface why the CRCR nightly report cannot read its Buildkite secret (#54860)
Signed-off-by: Andrey Talman <atalman@fb.com>
Andrey Talman committed
Sep 4, 2026 at 14:10 UTC
a11dfcff8921247c119b9356ae1c4bbd3a7f7f57
1 file changed
+28
-2
.buildkite/scripts/crcr-report.sh
+28
-2
@@ -39,10 +39,36 @@ fi
39
# the agent exposes only its own step, so the job list comes from the REST API.
40
TOKEN_SECRET_KEY="${CRCR_BUILDKITE_TOKEN_SECRET_KEY:-CRCR_BUILDKITE_API_TOKEN}"
41
BK_TOKEN="${BUILDKITE_API_TOKEN:-}"
42
-if [[ -z "${BK_TOKEN}" ]] && command -v buildkite-agent >/dev/null 2>&1; then
42
+if [[ -z "${BK_TOKEN}" ]]; then
43
# Not in the job environment, so read it from a Buildkite secret. The agent
44
# redacts values fetched this way from the log.
45
- BK_TOKEN="$(buildkite-agent secret get "${TOKEN_SECRET_KEY}" 2>/dev/null)" || BK_TOKEN=""
45
+ #
46
+ # Report why a lookup failed. Swallowing stderr made a missing secret, a
47
+ # denied policy and an unusable agent indistinguishable, all surfacing as the
48
+ # same "no token" line. Only stderr is echoed -- stdout is the secret.
49
+ if ! command -v buildkite-agent >/dev/null 2>&1; then
50
+ echo "buildkite-agent is not on PATH; cannot read secret '${TOKEN_SECRET_KEY}'"
51
+ else
52
+ secret_err="$(mktemp)"
53
+ # Deliberately not passing --skip-redaction. On the deployed agent
54
+ # (v3.73.1) the flag cannot help: secret_get.go creates the Job API
55
+ # client unconditionally and only checks SkipRedaction afterwards, so
56
+ # under the docker plugin -- which does not expose the Job API socket to
57
+ # the container -- it fails before the flag is read. That ordering was
58
+ # only fixed in v3.107.0. Skipping redaction would also stop the token
59
+ # being registered with the log redactor, for no gain here.
60
+ if BK_TOKEN="$(buildkite-agent secret get "${TOKEN_SECRET_KEY}" 2>"${secret_err}")"; then
61
+ if [[ -z "${BK_TOKEN}" ]]; then
62
+ echo "secret '${TOKEN_SECRET_KEY}' resolved but is empty"
63
+ fi
64
+ else
65
+ BK_TOKEN=""
66
+ echo "buildkite-agent secret get '${TOKEN_SECRET_KEY}' failed" \
67
+ "(agent $(buildkite-agent --version 2>&1 | head -1)):"
68
+ sed 's/^/ /' "${secret_err}"
69
+ fi
70
+ rm -f "${secret_err}"
71
+ fi
72
fi
73
if [[ -z "${BK_TOKEN}" ]]; then
74
echo "no Buildkite API token (env BUILDKITE_API_TOKEN or secret" \