iHore/vLLM
8
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Use skip-redaction option for crcr-report (#56532)

Browse Source 
Signed-off-by: khluu <khluu000@gmail.com>
Co-authored-by: khluu <khluu000@gmail.com>
Co-authored-by: Codex <noreply@openai.com>
This commit is contained in:
Andrey Talman
2026-09-16 19:01:54 -07:00
committed by GitHub
co-authored by khluu Codex
parent 28ec03bc6e
commit 062f81d8ef
1 changed files with 6 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.buildkite/scripts/crcr-report.sh
+6 -11
View File
@@ -40,8 +40,7 @@ fi
TOKEN_SECRET_KEY="${CRCR_BUILDKITE_TOKEN_SECRET_KEY:-CRCR_BUILDKITE_API_TOKEN}"
BK_TOKEN="${BUILDKITE_API_TOKEN:-}"
if [[ -z "${BK_TOKEN}" ]]; then
# Not in the job environment, so read it from a Buildkite secret. The agent
# redacts values fetched this way from the log.
# Not in the job environment, so read it from a Buildkite secret.
#
# Report why a lookup failed. Swallowing stderr made a missing secret, a
# denied policy and an unusable agent indistinguishable, all surfacing as the
@@ -50,14 +49,9 @@ if [[ -z "${BK_TOKEN}" ]]; then
echo "buildkite-agent is not on PATH; cannot read secret '${TOKEN_SECRET_KEY}'"
else
secret_err="$(mktemp)"
# Deliberately not passing --skip-redaction. On the deployed agent
# (v3.73.1) the flag cannot help: secret_get.go creates the Job API
# client unconditionally and only checks SkipRedaction afterwards, so
# under the docker plugin -- which does not expose the Job API socket to
# the container -- it fails before the flag is read. That ordering was
# only fixed in v3.107.0. Skipping redaction would also stop the token
# being registered with the log redactor, for no gain here.
if BK_TOKEN="$(buildkite-agent secret get "${TOKEN_SECRET_KEY}" 2>"${secret_err}")"; then
# Requires agent >= 3.107.0: the Docker plugin does not mount the Job API
# socket needed for redaction. Capture the value without logging it.
if BK_TOKEN="$(buildkite-agent secret get --skip-redaction "${TOKEN_SECRET_KEY}" 2>"${secret_err}")"; then
if [[ -z "${BK_TOKEN}" ]]; then
echo "secret '${TOKEN_SECRET_KEY}' resolved but is empty"
fi
@@ -77,7 +71,8 @@ if [[ -z "${BK_TOKEN}" ]]; then
fi
AUDIENCE="pytorch-cross-repo-ci-relay"
OIDC_TOKEN="$(buildkite-agent oidc request-token --audience "${AUDIENCE}" 2>/dev/null)"
# OIDC redaction also requires the unavailable Job API socket.
OIDC_TOKEN="$(buildkite-agent oidc request-token --skip-redaction --audience "${AUDIENCE}" 2>/dev/null)"
if [[ -z "${OIDC_TOKEN}" ]]; then
echo "could not mint a Buildkite OIDC token -- skipping report"
exit 0