feat(pipeline-doctor): assert no set -x in token-bearing ci scripts (#191)

2026-06-02 04:20:10 +03:00
parent b446cc25a8
commit 6d4fec3f71
2 changed files with 30 additions and 0 deletions
@@ -5,6 +5,15 @@
 All notable changes to parity-lib are documented here. This project follows
 semantic versioning; the version is a conceptual tag (no git tag is created).

+## Unreleased
+
+- `pipeline-doctor` (cluster #191 security sweep): added a scoped per-file check
+  asserting **no `set -x` in token-bearing `ci/*.sh` scripts** going forward — a
+  script that references a registry token (`REGISTRY_TOKEN` / `CI_REGISTRY_TOKEN`
+  / an `Authorization: token` header) must not enable xtrace, which would echo
+  the token to the build log. Token-free helpers (e.g. version parsers) are not
+  flagged.
+
 ## v0.1.0

 Initial release (cluster #192/#193/#194, emmett#44).