Merge pull request #76 from drone-runners/CI-15733

fix: [CI-15903]: Fixed secret masking issue with drone docker runner

Author: ShobhitSingh11

engine/compiler/compiler.go

@@ -390,15 +390,28 @@ func (c *Compiler) Compile(ctx context.Context, args runtime.CompilerArgs) runti
 		removeCloneDeps(spec)
 	}
 
+	// Creating an object to store a secret data which which will be injected across all steps for masking.
+	var secretData [][]byte
 	for _, step := range spec.Steps {
 		for _, s := range step.Secrets {
 			secret, ok := c.findSecret(ctx, args, s.Name)
 			if ok {
 				s.Data = []byte(secret)
+				secretData = append(secretData, []byte(secret))
 			}
 		}
 	}
 
+	for _, value := range secretData {
+		for _, step := range spec.Steps {
+			e := &engine.Secret{
+				Data: value,
+				Mask: true,
+			}
+			step.Secrets = append(step.Secrets, e)
+		}
+	}
+
 	// get registry credentials from registry plugins
 	creds, err := c.Registry.List(ctx, &registry.Request{
 		Repo:  args.Repo,
@@ -525,7 +538,6 @@ func (c *Compiler) Compile(ctx context.Context, args runtime.CompilerArgs) runti
 		}
 		spec.Volumes = append(spec.Volumes, src)
 	}
-
 	return spec
 }
 

engine/convert.go

@@ -32,7 +32,9 @@ func toConfig(spec *Spec, step *Step) *container.Config {
 		config.Env = toEnv(step.Envs)
 	}
 	for _, sec := range step.Secrets {
-		config.Env = append(config.Env, sec.Env+"="+string(sec.Data))
+		if sec.Env != "" {
+			config.Env = append(config.Env, sec.Env+"="+string(sec.Data))
+		}
 	}
 
 	if len(step.Entrypoint) != 0 {