Method validateEnvSecretsSection

pkg/workflow/strict_mode_env_validation.go:90–144

validateEnvSecretsSection checks a single config map's "env" key for secrets. sectionName is used in log and error messages (e.g. "env" or "engine.env"). allowedEnvVarKeys is an optional set of env var key names whose secret values are permitted (used for engine.env to allow overriding engine env va

(config map[string]any, sectionName string, allowedEnvVarKeys map[string]struct {
})

// allowedEnvVarKeys is an optional set of env var key names whose secret values are
// permitted (used for engine.env to allow overriding engine env vars).
func (c *Compiler) validateEnvSecretsSection(config map[string]any, sectionName string, allowedEnvVarKeys map[string]struct {
}) error {
	envValue, exists := config["env"]
	if !exists {
		strictModeValidationLog.Printf("No %s section found, validation passed", sectionName)
		return nil
	}

	// Check if env is a map[string]any
	envMap, ok := envValue.(map[string]any)
	if !ok {
		strictModeValidationLog.Printf("%s section is not a map, skipping validation", sectionName)
		return nil
	}

	// Convert to map[string]string for secret extraction, skipping keys whose secrets
	// are explicitly allowed (e.g. engine env var overrides in engine.env).
	envStrings := make(map[string]string)
	for key, value := range envMap {
		if allowedEnvVarKeys != nil && setutil.Contains(allowedEnvVarKeys, key) {
			strictModeValidationLog.Printf("Skipping allowed engine env var key in %s: %s", sectionName, key)
			continue
		}
		if strValue, ok := value.(string); ok {
			envStrings[key] = strValue
		}
	}

	// Extract secrets from env values
	secrets := ExtractSecretsFromMap(envStrings)
	if len(secrets) == 0 {
		strictModeValidationLog.Printf("No secrets found in %s section", sectionName)
		return nil
	}

	// Build list of secret references found
	var secretRefs []string
	for _, secretExpr := range secrets {
		secretRefs = append(secretRefs, secretExpr)
	}

	strictModeValidationLog.Printf("Found %d secret(s) in %s section: %v", len(secrets), sectionName, secretRefs)

	// In strict mode, this is an error
	if c.strictMode {
		return fmt.Errorf("strict mode: secrets detected in '%s' section will be leaked to the agent container. Found: %s. Use engine-specific secret configuration instead. See: https://github.github.com/gh-aw/reference/engines/", sectionName, strings.Join(secretRefs, ", "))
	}

	// In non-strict mode, emit a warning
	warningMsg := fmt.Sprintf("Warning: secrets detected in '%s' section will be leaked to the agent container. Found: %s. Consider using engine-specific secret configuration instead.", sectionName, strings.Join(secretRefs, ", "))
	fmt.Fprintln(os.Stderr, console.FormatWarningMessage(warningMsg))
	c.IncrementWarningCount()

	return nil
}