[eas-cli] clean up error handling in local builds - #4105
Open
douglowder wants to merge 3 commits into
Open
Conversation
eas build --local base64-encoded the job (which contains build credentials) and passed it as a command-line argument to eas-cli-local-build-plugin. On failure, @expo/spawn-async includes the command line in its error message, leaking the credentials to stderr; they were also visible in the process list. Pass the payload via the EAS_LOCAL_BUILD_PLUGIN_INPUT environment variable instead. The plugin reads it and deletes it from the environment immediately so build subprocesses do not inherit it, and the debug command dump redacts it. Only affects eas build --local; cloud and git-based (INTERNAL) builds do not use this path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
On a failed eas build --local, surface an allowlisted summary (platform, build profile, workflow, versions, package manager, project root, git commit + dirty flag, fingerprint, tracking/project IDs) to help debug the failure. Only known-safe fields are logged — never the raw job/metadata, which carries build credentials. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
✅ Thank you for adding the changelog entry! |
douglowder
marked this pull request as ready for review
July 28, 2026 21:38
|
Subscribed to pull request
Generated by CodeMention Warning: The preamble and epilogue options in commentConfiguration are deprecated. Use template instead. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4105 +/- ##
==========================================
+ Coverage 62.15% 62.22% +0.07%
==========================================
Files 993 993
Lines 44658 44674 +16
Branches 9403 9406 +3
==========================================
+ Hits 27754 27793 +39
+ Misses 15455 15432 -23
Partials 1449 1449 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
wschurman
removed their request for review
July 28, 2026 22:11
Member
|
deferring to other reviewers more familiar with builds on this |
Contributor
Author
|
Adding @szdziedzic since he also has worked on the local build plugin (even before it moved here) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Because all parameters were being passed to a local build as arguments, any error would cause all the parameters to be written to stderr as a large base64 string. This led to usability (error message awkward to read) and security (leaked credentials) issues.
How
Test Plan