getEngineEnvSecretsCodemod creates a codemod that removes unsafe secret-bearing entries from engine.env while preserving allowed engine-required secret overrides.
()
| 16 | // getEngineEnvSecretsCodemod creates a codemod that removes unsafe secret-bearing entries |
| 17 | // from engine.env while preserving allowed engine-required secret overrides. |
| 18 | func getEngineEnvSecretsCodemod() Codemod { |
| 19 | return Codemod{ |
| 20 | ID: "engine-env-secrets-to-engine-config", |
| 21 | Name: "Remove unsafe secrets from engine.env", |
| 22 | Description: "Removes secret-bearing engine.env entries that are not required engine secret overrides, preventing strict-mode leaks.", |
| 23 | IntroducedIn: "0.26.0", |
| 24 | Apply: func(content string, frontmatter map[string]any) (string, bool, error) { |
| 25 | engineValue, hasEngine := frontmatter["engine"] |
| 26 | if !hasEngine { |
| 27 | return content, false, nil |
| 28 | } |
| 29 | |
| 30 | engineMap, ok := engineValue.(map[string]any) |
| 31 | if !ok { |
| 32 | return content, false, nil |
| 33 | } |
| 34 | |
| 35 | envAny, hasEnv := engineMap["env"] |
| 36 | if !hasEnv { |
| 37 | return content, false, nil |
| 38 | } |
| 39 | |
| 40 | envMap, ok := envAny.(map[string]any) |
| 41 | if !ok { |
| 42 | return content, false, nil |
| 43 | } |
| 44 | |
| 45 | engineID := extractEngineIDForCodemod(frontmatter, engineMap) |
| 46 | allowed := allowedEngineEnvSecretKeys(engineID) |
| 47 | unsafeKeys := findUnsafeEngineEnvSecretKeys(envMap, allowed) |
| 48 | if len(unsafeKeys) == 0 { |
| 49 | return content, false, nil |
| 50 | } |
| 51 | |
| 52 | newContent, applied, err := applyFrontmatterLineTransform(content, func(lines []string) ([]string, bool) { |
| 53 | updated, modified := removeUnsafeEngineEnvKeys(lines, unsafeKeys) |
| 54 | if !modified { |
| 55 | return lines, false |
| 56 | } |
| 57 | cleaned := removeEmptyEngineEnvBlock(updated) |
| 58 | return cleaned, true |
| 59 | }) |
| 60 | if applied { |
| 61 | engineEnvSecretsCodemodLog.Printf("Removed unsafe engine.env secret keys: %v", sliceutil.MapKeys(unsafeKeys)) |
| 62 | } |
| 63 | return newContent, applied, err |
| 64 | }, |
| 65 | } |
| 66 | } |
| 67 | |
| 68 | func extractEngineIDForCodemod(frontmatter map[string]any, engineMap map[string]any) string { |
| 69 | if id, ok := engineMap["id"].(string); ok && id != "" { |