Commit 3efd3678 authored by Fabio Pitino's avatar Fabio Pitino

Merge branch 'fix/gb/remove-rails-ci-secrets-masking' into 'master'

Increment trace mutation metric when CI/CD secrets are masked

Closes #241189

See merge request gitlab-org/gitlab!40408
parents e267c3df 83696e88
......@@ -871,13 +871,17 @@ module Ci
options.dig(:release)&.any?
end
def hide_secrets(trace)
def hide_secrets(data, metrics = ::Gitlab::Ci::Trace::Metrics.new)
return unless trace
trace = trace.dup
Gitlab::Ci::MaskSecret.mask!(trace, project.runners_token) if project
Gitlab::Ci::MaskSecret.mask!(trace, token) if token
trace
data.dup.tap do |trace|
Gitlab::Ci::MaskSecret.mask!(trace, project.runners_token) if project
Gitlab::Ci::MaskSecret.mask!(trace, token) if token
if trace != data
metrics.increment_trace_operation(operation: :mutated)
end
end
end
def serializable_hash(options = {})
......
# frozen_string_literal: true
module Gitlab
module Ci
class Trace
class Metrics
extend Gitlab::Utils::StrongMemoize
OPERATIONS = [:mutated].freeze
def increment_trace_operation(operation: :unknown)
unless OPERATIONS.include?(operation)
raise ArgumentError, 'unknown trace operation'
end
self.class.trace_operations.increment(operation: operation)
end
def self.trace_operations
strong_memoize(:trace_operations) do
name = :gitlab_ci_trace_operations_total
comment = 'Total amount of different operations on a build trace'
Gitlab::Metrics.counter(name, comment)
end
end
end
end
end
end
......@@ -1052,18 +1052,53 @@ RSpec.describe Ci::Build do
end
describe '#hide_secrets' do
let(:metrics) { spy('metrics') }
let(:subject) { build.hide_secrets(data) }
context 'hide runners token' do
let(:data) { "new #{project.runners_token} data"}
it { is_expected.to match(/^new x+ data$/) }
it 'increments trace mutation metric' do
build.hide_secrets(data, metrics)
expect(metrics)
.to have_received(:increment_trace_operation)
.with(operation: :mutated)
end
end
context 'hide build token' do
let(:data) { "new #{build.token} data"}
it { is_expected.to match(/^new x+ data$/) }
it 'increments trace mutation metric' do
build.hide_secrets(data, metrics)
expect(metrics)
.to have_received(:increment_trace_operation)
.with(operation: :mutated)
end
end
context 'when build does not include secrets' do
let(:data) { 'my build log' }
it 'does not mutate trace' do
trace = build.hide_secrets(data)
expect(trace).to eq data
end
it 'does not increment trace mutation metric' do
build.hide_secrets(data, metrics)
expect(metrics)
.not_to have_received(:increment_trace_operation)
.with(operation: :mutated)
end
end
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment