astronomer / astro-cli / 39060680921

45%

Build Type

push

github

Committed by web-flow

Commit Message

Remove the plain-text file every connection and variable export leaves behind (#2219)

* Fix connection export leaving a plaintext temp file in the container

The connection export wrote connection URIs, with embedded plaintext
passwords, to tmp.connections inside the container, but the cleanup
step tried to delete tmp.connection (missing the trailing s), so the
file was never removed. This moves the export to a real path under
/tmp, uses one constant for the export, read, and remove commands so
the names can't drift apart again, and runs the removal via defer so
a failure partway through the read or write still cleans up the file.
Also fixes the success message's misspelling and grammar.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Remove every export's plain-text file whatever happens, and never in a shared /tmp

Reworks this PR after a code review. The leak stands: the connection
export had Airflow write every connection URI, passwords included, to
tmp.connections, then removed tmp.connection, so the file stayed. But:

- /tmp/connections.env is the host's shared /tmp in standalone mode,
  where these commands run with bash on the user's machine in the
  project's Airflow home, not in a container: a fixed name, readable by
  other users. Each export now has a file name of its own, relative, so
  in the container's working directory or the Airflow home. Two exports
  at once no longer read or remove each other's.
- The removal was set up only after an export that worked, so a failed
  or partial one, the likeliest to leave the file, kept it. One helper,
  readAirflowExport, sets up `rm -f` before the export runs; a removal
  that fails is a warning naming the file, not a failure of an export
  that worked.
- The variables exports (to a .env and to the settings file) had the
  same pattern with tmp.var, and kept it whenever reading it back
  failed. All three exports use the helper now.
- docker exec -t ends lines with \r\n, and every co... (continued)

Coverage Stats

93 of 98 new or added lines in 1 file covered. (94.9%)

12 existing lines in 2 files now uncovered.

27258 of 60395 relevant lines covered (45.13%)

9.85 hits per line