mirror of
https://github.com/coder/coder.git
synced 2026-10-16 14:48:56 +08:00
Steven Masley
357e81b470
Workspace build audit entries now list the build's secrets: name, env var, file path, and whether the request set the secret or it was carried forward from the previous build. Values are never included. Follows up on [this review thread](https://github.com/coder/coder/pull/30250#discussion_r4199276004). **Stack** (design decisions in #30248) 1. #30248 Database schema, queries, and RBAC 2. #30249 Encryption at rest 3. #30250 Set secrets on workspace builds 4. #30251 Deliver secrets to the agent 5. #30252 Docs 6. #30388 List a build's secrets 7. **#30459 Audit a build's secrets (this PR)** - Every workspace build audit entry includes its secrets, including builds that fail and orphaned deletes. - The entry lists the build's full set of secrets. Removed secrets show up only by being absent. - The three places that write build audit entries now share one helper instead of building the fields by hand. <details> <summary>Implementation details</summary> - `audit.AdditionalFields` gains `workspace_secrets`: `name`, `env_name`, `file_path`, and `source` (`request` or `carry_forward`) for each secret. - New `audit.WorkspaceBuildFields` is used for job success and failure in `provisionerdserver`, and for the orphan delete completed in `workspacebuilds.go`. - `source` comes from the `workspace_secrets.source` column (#30248), set by `persistSecrets` (#30250). </details> <details> <summary>Decision log</summary> (existing decision log, unchanged) </details> --- *Created by Coder Agents on behalf of @Emyrk.*