Skip to content

Restrict deploy commands to explicitly configured environment variables #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
LAIM69420 wants to merge 1 commit into from
Closed

Restrict deploy commands to explicitly configured environment variables #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/built/sandbox/deploy_runner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,9 @@ async def _run_deploy_command(deploy_config: DeployConfig, *, cwd) -> DeployRunR
if not command:
return DeployRunResult(success=False, message=f"no {deploy_config.kind.value} configured")

env = os.environ.copy()
# Keep ordinary command lookup working without exposing every secret held by
# the orchestrator process. Deploy credentials are opt-in via env_var_refs.
env = {"PATH": os.environ.get("PATH", os.defpath)}
for ref in deploy_config.env_var_refs:
if ref in os.environ:
env[ref] = os.environ[ref]
Expand Down
20 changes: 20 additions & 0 deletions tests/integration/test_deploy_runner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
import httpx
import pytest

from built.db.models import DeployConfig
from built.domain.enums import DeployKind, DeployMode
from built.sandbox import deploy_runner
from built.sandbox.worktree import create_card_worktree, ensure_tool_worktree
Expand Down Expand Up @@ -175,6 +176,25 @@ async def test_run_auto_main_deploy_deploy_command_failure(db_session, deployabl
assert "exited 1" in result.message


async def test_deploy_command_exposes_only_explicit_environment_refs(monkeypatch, tmp_path):
monkeypatch.setenv("ALLOWED_DEPLOY_SECRET", "allowed")
monkeypatch.setenv("UNDECLARED_HOST_SECRET", "must-not-leak")
config = DeployConfig(
project_id="p",
kind=DeployKind.COMMAND,
mode=DeployMode.AUTO_MAIN,
command=(
'test "$ALLOWED_DEPLOY_SECRET" = allowed '
'&& test -z "${UNDECLARED_HOST_SECRET+x}"'
),
env_var_refs=["ALLOWED_DEPLOY_SECRET"],
)

result = await deploy_runner._run_deploy_command(config, cwd=tmp_path)

assert result.success is True, result.message


async def test_run_auto_main_deploy_merge_conflict_reports_conflicted_paths(
db_session, deployable_repo_remote
):
Expand Down