secure-environment-variables have visible values in azure portal about aci-deploy HOT 11 CLOSED

@sroebert Yeah, unfortunately they need to build the project again. There have been a number of other changes since it was last built and checked in too - and the latest "release" was almost year and a half ago.

Our solution was to fork the repository, build it, and reference that in the Github workflow file. Example:

# Using forked aci-deploy because Microsoft isn't keeping up with official releases on the original repo
- name: 'Deploy to Azure Container Instances'
  uses: 'el-pato/aci-deploy@master'

@kanika1894 can we get recent changes built and checked in to the repo? And preferably a new release? Should we open an issue or PR for these things?

from aci-deploy.

This won't work as the current code does not have the latest build js files, only the ts source files are updated.

from aci-deploy.

I'm having exactly the same problem, all variables passed as 'secure-environment-variables' have visible values in Portal

from aci-deploy.

This issue is idle because it has been open for 14 days with no activity.

from aci-deploy.

Same problem here

from aci-deploy.

This seems to have been fixed in #51, but the compiled js file does not yet contain the latest changes: https://github.com/Azure/aci-deploy/blob/bcb0a1ca5eb61aeb1f26a0d285bb7d62b9ce96ff/lib/taskparameters.js

from aci-deploy.

@sroebert @kanika1894 actually I just saw that there is a newer release, but it's not marked as the "latest" release. https://github.com/Azure/aci-deploy/releases/tag/v1.1.2

You might be able to target that by doing something like:

- name: 'Deploy to Azure Container Instances'
  uses: 'Azure/[email protected]'

I haven't tried this yet. I will and then update here if nobody else has yet.

from aci-deploy.

@sroebert just scanned the v1.1.2 release files, looks like you're right.

@kanika1894 can we get this project rebuilt and checked in again? Preferably with a release marked as "latest".

from aci-deploy.

@el-pato @sroebert @HonzaV
Thanks for pointing out the issue. The required fix has been made (#60)
A new release v1.1.3 is created along with updating the v1 version.

from aci-deploy.

@sroebert @HonzaV @kanika1894

I just ran a test using the v1.1.3 release, and I don't see any secure environment variable values in any logs. I think we're good!

from aci-deploy.

Thanks for the update @el-pato.
fyi, using just v1 will also give the same experience.

from aci-deploy.