log-tail: redact webhook credentials before export; deploy from CI - #715
Open
ZIJ wants to merge 1 commit into
Open
log-tail: redact webhook credentials before export; deploy from CI#715ZIJ wants to merge 1 commit into
ZIJ wants to merge 1 commit into
Conversation
The collector exported the full request path, and console messages that quoted it, to Axiom. Agent webhook URLs are about to carry their credential in the path (opencomputer#714, blue#45), so everything after the webhook id is replaced with `redacted` in request_url, console messages, and exception text. Regression tests cover a 502 record with no console logs, a malformed trailing path, and an emitter that quoted the path. Adds a package manifest and .github/workflows/deploy-log-tail.yml so the collector deploys on push to main when its files change. Split out of #714 so redaction is live before the URLs exist. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RKjbUpydN8ju2ZLxukbWLQ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split out of #714 so the collector's redaction is live before any credential-bearing webhook URL exists. Merging this deploys
opencomputer-log-tail-prodthrough the new workflow.Behavior changed
request_url, console messages, and exception text have everything after/api/agent-webhooks/<id>/or/v1/agent-webhooks/<id>/replaced withredactedbefore export to Axiom..github/workflows/deploy-log-tail.yml: deploys on push to main whencloudflare-workers/log-tail/**changes, or byworkflow_dispatch, using the sameCLOUDFLARE_API_TOKENas the api-edge workflow (same account).AXIOM_TOKENstays as the Worker secret it already is;--keep-vars.Verification
Three collector tests pass, including a 502 record with no console logs, a malformed trailing path, and an emitter line quoting the path.
wrangler deploy --dry-runagainstwrangler.prod.tomlpasses.Release order
Merge this first, then diggerhq/blue#45, then #714, which contains the same collector changes and merges cleanly on top.
🤖 Generated with Claude Code
https://claude.ai/code/session_01RKjbUpydN8ju2ZLxukbWLQ