REQ 017

REQ-017: Credential temp files shredded/removed after use

Requirement

A credential file written during provisioning shall not be left behind after the step that uses it completes.

Rationale

Avoids leaking a secret into retained CI artifacts/logs beyond the single step that legitimately needs it.

Fit Criterion

Every step in provision-windows-labview-vm.yml that writes the guest/WinRM password file or the runner-registration PAT file shreds it (falling back to rm -f) before the step ends: the create-vm, install-vipm, install-labview, "Attach Installer Media And Restart", and register-runner steps all clean up the guest/WinRM password file they wrote, and register-runner additionally cleans up its PAT file.

Verification

Code review of every GUEST_PASSWORD_FILE/WINRM_PASSWORD_FILE/PAT_FILE write site in provision-windows-labview-vm.yml and its matching shred (with a rm -f fallback) cleanup line.

Source

Software-Requirements-Specification

Priority

Medium

TestID

TEST-017

TestArtifact

Code review of every password-file and PAT-file write site's matching cleanup line

CodeRef

.github/workflows/provision-windows-labview-vm.yml (create-vm, install-vipm, install-labview, restart, and register-runner steps)

Status

Verified (manual)