astronomer / astro-cli / 38582239282

58%

main: 45%

push

github

Keep secrets out of shipped images, and deploy to DAG-deploy-off Deployments (#2306)

* Keep secrets out of shipped images, and deploy to DAG-deploy-off Deployments

A default deploy to a Deployment with DAG deploys off now ships the image
alone with the DAGs inside it, as 1.x did, instead of refusing. --image
there is refused as 1.x refused it, and a generated image whose
.dockerignore drops every DAG is refused before the build.

Shipped images always leave out the .env family and airflow_settings.yaml
at any depth, and a root airflow.db, airflow.cfg and logs/. The list lives
in pkg/airflowrt beside the per-machine one, so a declared Dockerfile's
.dockerignore gets the same rules.

Deploy and astro package astro warn about gitignored files the image would
carry and refuse those that look like credentials.

Co-Authored-By: Claude <noreply@anthropic.com>

* Address review: links, untracked keys, remote execution, .git, one survey

- Ask git about a file behind a linked directory where the link leads (or
  as the link), so one link cannot fail the repository's query.
- Refuse untracked credential-looking files too; committed ones never.
- Where git cannot answer, warn with its reason and the files; do not refuse.
- Remote execution with DAG deploys off: no upload, --image allowed, and no
  refusal for a .dockerignore that drops the DAGs.
- Declared Dockerfiles: **/.git in the scaffolded ignore rules; .git in the
  context is warned about, and refused when its config holds a credential.
  Refuse only when the Dockerfile copies the whole context, else warn.
- Read .containerignore first for a declared build's survey.
- Add .pgpass, .docker/config.json, token.json, client_secret*.json.
- Survey once per command and hand it to every check; set-based lookups.
- check-ignore exit 1 is "nothing ignored" whatever it wrote to stderr.

Co-Authored-By: Claude <noreply@anthropic.com>

* Simplify the ship check: whole context counts, links out count untracked

- A ... (continued)

417 of 438 new or added lines in 7 files covered. (95.21%)

40744 of 70157 relevant lines covered (58.08%)

244.15 hits per line