[PRIVACY] test step's prompt invites environment inspection, so the agent prints credential variable names into the persisted transcript

Summary

The test step's agent inspected its environment while diagnosing a failure and printed the merged environment into its transcript, which recorded roughly a dozen credential variable names — names of secrets belonging to the host, not to the project under validation. No values were exposed; this is a names-only disclosure. But the transcript is persisted as a step log, so the disclosure is durable, and because one shared pipeline serves every repository on the machine, every project validated through it is exposed to the same thing.

Observed 2026-08-11 during a template uplift's validation.

Verification of the exposure, so the severity is not overstated

Both persisted step logs, the resulting commit and the run worktree were checked for value patterns (ghp_, github_pat_, AKIA, AGE-SECRET-KEY-, BEGIN blocks, glpat-, xoxb-) and for NAME=value assignments. All zero. Names only, no key material, nothing durable in the repository, nothing to rotate. That is why this is filed as a hardening request rather than an incident.

Likely mechanism, and why it is an instruction rather than a bug

There is no code path in the pipeline that dumps the environment — I grepped for one and there is none. The mechanism appears to be the step prompt itself. internal/pipeline/steps/test.go says, at both line 58 and line 186 on v1.67.0-2-g9862979 (2026-09-05, so still present on current):

If tests fail, determine whether the problem is a real product/code failure, a setup/environment problem you can fix, or a flaky/infrastructure issue.

An agent following that instruction faithfully will inspect its environment, and the cheapest way to inspect an environment is to print all of it. Nothing in the prompt suggests reading only the variables it needs, and nothing redacts the result on the way into the transcript.

To be explicit about what I did and did not verify: the environment-variable check above was done at the time by a second reviewer against the actual logs; the prompt-clause attribution is inference from current source made today, not a re-read of that transcript.

Suggested fixes, either of which would close it

1. One clause in the prompt. Something like "inspect specific environment variables by name if you need them; do not print the whole environment." Cheapest, and it addresses the cause rather than the symptom.
2. Redact at transcript-write time. Filter lines that look like a bulk environment listing, or at minimum drop variables whose names match the usual credential shapes, before the step log is persisted. Catches this regardless of what any future prompt or agent does, which the prompt fix does not.

Both are worth having: (1) stops it happening, (2) stops it mattering when some other step or a future agent does the same thing.

Version note

Prompt text confirmed present on v1.67.0-2-g9862979. The original observation was made on an earlier version; the behaviour was not re-run on current, since the fix suggested here is to source that is demonstrably still in place.