Repository navigation
[AW Top 10] 04 Fix redact-secrets step failing after successful agent runs #66818
Description
Activity
Closing as already fixed. Root cause: PR #66160 made writable-file preparation in
redact_secrets.cjsunconditional, so unchanged/secret-free files in read-only directories (e.g. the firewall sandbox'ssandbox/firewall/audit/*) were rewritten in place; when that unnecessary rewrite failed and fallback cleanup also failed, it escalated to a job-failingERR_VALIDATION: Failed to remove artifact source after secret redaction failed, despite the agent itself succeeding.Fix: PR #66995 (merged 2026-10-08, building on #66160/#66698) gates file rewriting behind
totalRedactions > 0 || prepareForCustomMasking, leaving unchanged read-only files untouched. Confirmed present on current main. Regression coverage validated locally:redact_secrets.test.cjs(82/82 passing) and GoTestSecretRedactionPreparesFilesOnlyForCustomMaskingboth cover the non-writable-file-in-scanned-directory scenario from this issue. No new recurrence since the fix merged.
Priority 4/10 | 6 source issues | Impact 4/5 | Confidence 3/5 | Effort 2/5
One assignment, one coherent fix
A post-execution secret redaction step fails the agent job across several engines even after the agent completed its work.
Implementation scope
Make the redaction script tolerate non-writable and replaced files, fail only on real leaks, and add a regression test using the firewall sandbox file layout from the report.
Done when
Why now
The report documents four distinct workflows and three engines failing identically, and it is novel; matching failed-job issues corroborate it, though their cause was not individually verified.
AW source issues and corroborating reports
#66273 #66282 #66305 #66479 #66706 #66880
No corroborating AW discussion; evidence comes from the source issues.
Unchanged AW sources close only after this summary is completed. Newer source activity and not-planned retirement do not trigger source closure. Assigned summaries are frozen; unassign to allow reclustering.