Skip to content

fix(cli): redact env vars from attempt debug logs - #4472

Closed
RealBhupesh wants to merge 1 commit into
triggerdotdev:mainfrom
RealBhupesh:codex/trigger-3566-redact-attempt-log
Closed

fix(cli): redact env vars from attempt debug logs#4472
RealBhupesh wants to merge 1 commit into
triggerdotdev:mainfrom
RealBhupesh:codex/trigger-3566-redact-attempt-log

Conversation

@RealBhupesh

@RealBhupesh RealBhupesh commented Aug 2, 2026

Copy link
Copy Markdown

Summary

  • Exclude task environment variable values from the managed attempt debug-log payload.
  • Preserve the full response for execution, including environment variables needed to start the task.
  • Add regression coverage and the required trigger.dev patch changeset.

Root cause

The started attempt debug log serialized the complete start response, which included the task environment variables.

Validation

  • Targeted redaction test: 1 passed.
  • Formatting and lint checks passed.
  • Full CLI package build is currently blocked by pre-existing missing generated workspace dependencies and baseline TypeScript errors in this checkout.

This issue is already public. New security vulnerabilities should use the private reporting path in SECURITY.md.

Please keep this PR in draft until vouching and CI review are complete.

fixes #3566

@changeset-bot

changeset-bot Bot commented Aug 2, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: f6c96ce

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages
Name Type
trigger.dev Patch
@internal/dashboard-agent Patch
@trigger.dev/build Patch
@trigger.dev/core Patch
@trigger.dev/python Patch
@trigger.dev/react-hooks Patch
@trigger.dev/redis-worker Patch
@trigger.dev/rsc Patch
@trigger.dev/schema-to-json Patch
@trigger.dev/sdk Patch
@trigger.dev/database Patch
@trigger.dev/otlp-importer Patch
@trigger.dev/rbac Patch
@trigger.dev/sso Patch
@internal/cache Patch
@internal/clickhouse Patch
@internal/llm-model-catalog Patch
@internal/metrics-pipeline Patch
@internal/redis Patch
@internal/replication Patch
@internal/run-engine Patch
@internal/run-store Patch
@internal/schedule-engine Patch
@internal/testcontainers Patch
@internal/tracing Patch
@internal/tsql Patch
@internal/sdk-compat-tests Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actions Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Hi @RealBhupesh, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details.

@github-actions github-actions Bot closed this Aug 2, 2026
@coderabbitai

coderabbitai Bot commented Aug 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b00274a-69e6-4686-94d1-34009fb094d3

📥 Commits

Reviewing files that changed from the base of the PR and between 14824b0 and f6c96ce.

📒 Files selected for processing (4)
  • .changeset/redact-attempt-debug-env.md
  • packages/cli-v3/src/entryPoints/managed/execution.ts
  • packages/cli-v3/src/entryPoints/managed/runAttemptLogData.test.ts
  • packages/cli-v3/src/entryPoints/managed/runAttemptLogData.ts

Walkthrough

The change adds getWorkloadRunAttemptStartLogData to retain run, snapshot, and execution data while excluding envVars. The started-attempt debug log uses this filtered data instead of the raw API response. A test verifies the redaction and retained fields. A patch changeset documents the update.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@RealBhupesh RealBhupesh mentioned this pull request Aug 2, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Self-hosted v4 runner pods leak process.env to stdout and to the webapp debug-log endpoint

1 participant

@RealBhupesh