From 0df592504f365e03a10b8c5180176fa01f7b2af3 Mon Sep 17 00:00:00 2001 From: Simone Date: Sun, 17 May 2026 17:28:35 +0200 Subject: [PATCH] fix(job): surface redacted git stderr from host-side clone _host_clone hid all stderr ("exit 128" with no cause). Surface the last stderr lines with scheme://user:pass@ credentials masked, so failures (e.g. unresolved SSH alias under LocalSystem) are diagnosable. Co-Authored-By: Claude Opus 4.7 --- src/ci_orchestrator/commands/job.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/ci_orchestrator/commands/job.py b/src/ci_orchestrator/commands/job.py index db1aa2a..afef004 100644 --- a/src/ci_orchestrator/commands/job.py +++ b/src/ci_orchestrator/commands/job.py @@ -195,6 +195,11 @@ def _make_clone_name(job_id: str) -> str: return f"Clone_{job_id}_{timestamp}_{suffix}" +def _redact_url_creds(text: str) -> str: + """Mask ``scheme://user:pass@host`` credentials in arbitrary text.""" + return re.sub(r"(\w+://)[^/\s:@]+:[^/\s@]+@", r"\1***@", text) + + def _host_clone( repo_url: str, branch: str, commit: str, submodules: bool ) -> tuple[Path, Path]: @@ -202,8 +207,8 @@ def _host_clone( Returns ``(tmp_root, src_dir)``. ``src_dir`` is passed as ``host_source_dir`` to the build (zipped and transferred to the - guest). The caller must remove ``tmp_root`` when done. The repo URL - may embed credentials, so git output is never echoed. + guest). The caller must remove ``tmp_root`` when done. git stderr is + surfaced with embedded URL credentials redacted. """ tmp_root = Path(tempfile.mkdtemp(prefix="ci-host-clone-")) src_dir = tmp_root / "src" @@ -225,9 +230,10 @@ def _host_clone( ) except subprocess.CalledProcessError as exc: shutil.rmtree(tmp_root, ignore_errors=True) - # Do not surface stderr verbatim — it can contain the authed URL. + detail = _redact_url_creds((exc.stderr or "").strip()) + tail = " | ".join(detail.splitlines()[-3:]) if detail else "(no stderr)" raise click.ClickException( - f"host-side git clone failed (exit {exc.returncode})" + f"host-side git clone failed (exit {exc.returncode}): {tail}" ) from None return tmp_root, src_dir