fix: prevent secret tracing in dependency build stages

[QuantumExplorer]

What

• disable shell command tracing in the Drive and rs-dapi dependency stages that consume an optional GitHub credential
• require a non-empty mounted credential before configuring Git authentication
• remove the temporary Git configuration through an exit trap on both successful and failed builds

Why

The affected stages expanded a mounted credential while command tracing was enabled. Raw build output could therefore include credential material even though BuildKit kept the mounted file out of image layers.

This covers PLATFORM-DS-CAND-376.

Checks

• Dockerfile diff and whitespace validation
• synthetic credential output test: marker absent from stdout and stderr
• failure-path cleanup test: temporary Git configuration removed

A Docker build parser check was attempted, but the local Docker daemon is not running.

Summary by CodeRabbit

• Bug Fixes
  • Improved Docker build reliability by enforcing stricter shell error handling.
  • Updated credential cleanup to run automatically when build steps exit.
  • Prevented empty secret files from triggering Git URL rewriting.
  • Simplified build-cache statistics handling while maintaining cleanup safeguards.

[coderabbitai]

Warning

Review limit reached

@QuantumExplorer, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 6 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 99d3d9e2-c51e-4fb4-9c7c-cc9740198a6a

📥 Commits

Reviewing files that changed from the base of the PR and between 0389415 and 475f09f.

📒 Files selected for processing (1)

• Dockerfile

📝 Walkthrough

Walkthrough

The Dockerfile updates shell execution flags and cargo dependency-cache preparation in the build-drive-abci and build-rs-dapi stages, including exit-trap cleanup and non-empty GitHub secret checks.

Changes

Docker build cache shell handling

Layer / File(s)	Summary
Update build-stage shell and cache preparation Dockerfile	Both stages enable Bash pipefail and -e, remove -x tracing, clean ~/.gitconfig through an EXIT trap, and only rewrite GitHub URLs when the secret file is non-empty.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: shumkov

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: reducing secret exposure in dependency build stages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-docker-build-secret-logging

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

🕓 Ready for review — 37 ahead in queue (commit 475f09f)
Queue position: 38/72 · 2 reviews active
ETA: start ~04:34 UTC · complete ~05:03 UTC (median 28m across 30 recent reviews; 2 slots)
Queued 12h 45m ago · Last checked: 2026-07-22 19:40 UTC

[infraclaw-dash]

Requesting changes because the credential can still be emitted to build logs on a Git failure.

Lines 467 and 889, plus the existing occurrence at line 645, embed GITHUB_TOKEN as the URL username. Git includes URL usernames in stderr. I reproduced this failure output with a synthetic token:

fatal: could not read Password for https://SYNTHETIC_TOKEN_DO_NOT_USE@github.com

Please use a non-secret username and put the token in the password position, for example https://x-access-token:TOKEN@github.com/, or use a credential helper. Git redacts URL passwords in errors. Please update all three occurrences.

The EXIT trap and removal of xtrace otherwise look correct. The Docker build checks were skipped, so this Dockerfile change has not been exercised by CI.

[infraclaw-dash]

I implemented the requested credential redaction fix in #4179. It updates all three URL rewrites and passes the synthetic failure-output check. This account cannot push directly to the PR branch, so #4179 targets codex/fix-docker-build-secret-logging and can be merged into this PR.