From 3b3d5b3386ecad7306a58d9c66f336c5c309c432 Mon Sep 17 00:00:00 2001
From: Albrecht Degering <albrecht@degering.name>
Date: Mon, 3 Aug 2026 18:36:00 +0200
Subject: [PATCH] Redact runtime smoke diagnostics

---
 tests/test_runtime_image_smoke.py   | 7 +++++--
 tools/checks/runtime-image-smoke.py | 9 +++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/tests/test_runtime_image_smoke.py b/tests/test_runtime_image_smoke.py
index d73f6cc..73a7978 100644
--- a/tests/test_runtime_image_smoke.py
+++ b/tests/test_runtime_image_smoke.py
@@ -56,17 +56,20 @@ class RuntimeImageSmokeTests(unittest.TestCase):
 
     def test_readiness_fails_immediately_when_container_exits(self) -> None:
         exited = subprocess.CompletedProcess([], 0, "false\n", "")
-        logs = subprocess.CompletedProcess([], 0, "fatal startup error\n", "")
+        logs = subprocess.CompletedProcess(
+            [], 0, "fatal startup error db-secret\n", ""
+        )
         with patch.object(MODULE, "_run", side_effect=(exited, logs)):
             with self.assertRaisesRegex(
                 MODULE.SmokeError,
-                "container exited before readiness: fatal startup error",
+                r"container exited before readiness: fatal startup error \[redacted\]",
             ):
                 MODULE._wait_for(
                     "WebUI",
                     lambda: self.fail("probe must not run for an exited container"),
                     timeout=60,
                     container="web",
+                    redactions=("db-secret",),
                 )
 
     def test_smoke_supplies_the_packaged_web_upstream_and_schema_contract(self) -> None:
diff --git a/tools/checks/runtime-image-smoke.py b/tools/checks/runtime-image-smoke.py
index 1bbbf45..a02e28c 100644
--- a/tools/checks/runtime-image-smoke.py
+++ b/tools/checks/runtime-image-smoke.py
@@ -105,6 +105,7 @@ def _wait_for(
     *,
     timeout: float,
     container: str | None = None,
+    redactions: Sequence[str] = (),
 ) -> None:
     deadline = time.monotonic() + timeout
     last = ""
@@ -122,6 +123,9 @@ def _wait_for(
                     timeout=30,
                 )
                 detail = _tail(logs.stdout + logs.stderr, limit=8000)
+                for secret in redactions:
+                    if secret:
+                        detail = detail.replace(secret, "[redacted]")
                 raise SmokeError(
                     f"{label} container exited before readiness: "
                     f"{detail or 'no diagnostic output'}"
@@ -330,6 +334,7 @@ def run_smoke(
             ),
             timeout=timeout,
             container=names["postgres"],
+            redactions=redactions,
         )
         _wait_for(
             "Redis",
@@ -340,6 +345,7 @@ def run_smoke(
             ),
             timeout=timeout,
             container=names["redis"],
+            redactions=redactions,
         )
         record("managed_dependencies_ready", began)
 
@@ -447,6 +453,7 @@ def run_smoke(
             ),
             timeout=timeout,
             container=names["api"],
+            redactions=redactions,
         )
         _run(
             (
@@ -506,6 +513,7 @@ def run_smoke(
             ),
             timeout=timeout,
             container=names["web"],
+            redactions=redactions,
         )
         _run(
             ("docker", "exec", names["web"], "sh", "-c", "test \"$(id -u)\" = 101"),
@@ -568,6 +576,7 @@ def run_smoke(
             ),
             timeout=timeout,
             container=names["worker"],
+            redactions=redactions,
         )
         _run(("docker", "stop", "--time", "20", names["worker"]), timeout=30)
         record("worker_delivery_and_shutdown", began)