RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: avoid printing partial Render API key in setup-deploy 

The previous `echo $RENDER_API_KEY | head -c 4` still leaked 4 bytes
of the secret into terminal scrollback. Replace with a presence check
that confirms whether the variable is set without exposing any bytes.

Fixes #1078

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
jacob-wang 2026-04-20 20:40:20 +08:00
parent d0782c4c4d
commit aae13a051a
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
setup-deploy/SKILL.md
View File

@ -856,7 +856,14 @@ Ask the user to confirm the production URL. Some Fly apps use custom domains.
If `render.yaml` detected:
1. Extract service name and type from render.yaml
2. Check for Render API key: `echo $RENDER_API_KEY | head -c 4` (don't expose the full key)
2. Check for Render API key:
```bash
if [ -n "${RENDER_API_KEY:-}" ]; then
echo "RENDER_API_KEY: set"
else
echo "RENDER_API_KEY: not set"
fi
```
3. Infer URL: `https://{service-name}.onrender.com`
4. Render deploys automatically on push to the connected branch — no deploy workflow needed
5. Set health check: the inferred URL

9
setup-deploy/SKILL.md.tmpl
View File

@ -99,7 +99,14 @@ Ask the user to confirm the production URL. Some Fly apps use custom domains.
If `render.yaml` detected:
1. Extract service name and type from render.yaml
2. Check for Render API key: `echo $RENDER_API_KEY | head -c 4` (don't expose the full key)
2. Check for Render API key:
```bash
if [ -n "${RENDER_API_KEY:-}" ]; then
echo "RENDER_API_KEY: set"
else
echo "RENDER_API_KEY: not set"
fi
```
3. Infer URL: `https://{service-name}.onrender.com`
4. Render deploys automatically on push to the connected branch — no deploy workflow needed
5. Set health check: the inferred URL