golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 3 Packages Projects Releases Wiki Activity

fix(#4639): exempt the container --env-file value from the secret-read guard (#4789)

Browse Source 
* fix(#4639): exempt the container --env-file value from the secret-read guard

* test(#4639): adopt the suite assertions and pin the reclassified row

* docs(#4639): document and pin the container-env printenv residual

* docs(#4639): backfill changeset PR number

---------

Co-authored-by: sim <sim@local>
This commit is contained in:
Tom Boucher
2026-09-16 06:44:55 -04:00
committed by GitHub
parent 003d982c83
commit f0a1745e29
3 changed files with 106 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/lively-lynx-hum.md Normal file
View File

@@ -0,0 +1,5 @@
---
type: Fixed
pr: 4789
---
**The secret-read guard no longer blocks container --env-file** — `docker`/`docker compose`/`podman`/`nerdctl` --env-file passes a file to the runtime without its contents ever reaching the conversation, so the operational rebuild works again; direct reads of secrets still block. (#4639)