chore: secrets are removed when claiming the task

Signed-off-by: blam <ben@blam.sh>

plugins/scaffolder-backend/src/scaffolder/tasks/DatabaseTaskStore.ts

@@ -43,7 +43,7 @@ export type RawDbTaskRow = {
   status: Status;
   last_heartbeat_at?: string;
   created_at: string;
-  secrets?: string;
+  secrets?: string | null;
 };
 
 export type RawDbTaskEventRow = {
@@ -139,8 +139,8 @@ export class DatabaseTaskStore implements TaskStore {
         .update({
           status: 'processing',
           last_heartbeat_at: this.db.fn.now(),
-          // remove the secrets when moving moving to processing state
-          secrets: undefined,
+          // remove the secrets when moving moving to processing state.
+          secrets: null,
         });
 
       if (updateCount < 1) {
@@ -237,8 +237,8 @@ export class DatabaseTaskStore implements TaskStore {
         })
         .update({
           status,
-          secrets: null as any,
         });
+
       if (updateCount !== 1) {
         throw new ConflictError(
           `Failed to update status to '${status}' for taskId ${taskId}`,

plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts

@@ -472,6 +472,33 @@ describe('DefaultWorkflowRunner', () => {
     });
   });
 
+  describe('secrets', () => {
+    it('should pass through the secrets to the context', async () => {
+      const task = createMockTaskWithSpec(
+        {
+          apiVersion: 'scaffolder.backstage.io/v1beta3',
+          steps: [
+            {
+              id: 'test',
+              name: 'name',
+              action: 'jest-mock-action',
+              input: {},
+            },
+          ],
+          output: {},
+          parameters: {},
+        },
+        { foo: 'bar' },
+      );
+
+      await runner.execute(task);
+
+      expect(fakeActionHandler).toHaveBeenCalledWith(
+        expect.objectContaining({ secrets: { foo: 'bar' } }),
+      );
+    });
+  });
+
   describe('filters', () => {
     it('provides the parseRepoUrl filter', async () => {
       const task = createMockTaskWithSpec({

plugins/scaffolder-backend/src/scaffolder/tasks/StorageTaskBroker.test.ts

@@ -94,13 +94,12 @@ describe('StorageTaskBroker', () => {
     expect(taskRow.status).toBe('completed');
   }, 10000);
 
-  it('should remove secrets after completing a task', async () => {
+  it('should remove secrets after picking up a task', async () => {
     const broker = new StorageTaskBroker(storage, logger);
     const dispatchResult = await broker.dispatch({} as TaskSpec, fakeSecrets);
-    const task = await broker.claim();
-    await task.complete('completed');
+    await broker.claim();
+
     const taskRow = await storage.getTask(dispatchResult.taskId);
-    expect(taskRow.status).toBe('completed');
     expect(taskRow.secrets).toBeUndefined();
   }, 10000);
 
@@ -113,16 +112,6 @@ describe('StorageTaskBroker', () => {
     expect(taskRow.status).toBe('failed');
   });
 
-  it('should remove secrets after failing a task', async () => {
-    const broker = new StorageTaskBroker(storage, logger);
-    const dispatchResult = await broker.dispatch({} as TaskSpec, fakeSecrets);
-    const task = await broker.claim();
-    await task.complete('failed');
-    const taskRow = await storage.getTask(dispatchResult.taskId);
-    expect(taskRow.status).toBe('failed');
-    expect(taskRow.secrets).toBeUndefined();
-  });
-
   it('multiple brokers should be able to observe a single task', async () => {
     const broker1 = new StorageTaskBroker(storage, logger);
     const broker2 = new StorageTaskBroker(storage, logger);