Description
Repository URLs in Build Cache analytics now get additional secret redaction - We’ve added an extra layer of protection to repository URLs stored in Build Cache analytics by stripping embedded Git credentials before storage across Gradle, Xcode, Bazel, and React Native.
Highlights:
- Embedded Git credentials are now removed: Repository URLs that include credentials in the format
https://user:token@host/...are now sanitized before being stored in Build Cache analytics. - Built on existing secret redaction: This extends our existing protection model, where every value you declare as a secret is already redacted everywhere it appears in your build data.
- Protects private repository access tokens: Some private repository URLs can contain embedded access tokens. This update ensures those credentials are never retained in analytics.
- Can affect repository URL display if trivial values are marked as secrets: Because secret redaction now also applies inside repository URLs, any declared secret that appears there will be masked too.
- Important configuration note: If your secret list contains short or common non-sensitive values such as
android,app, your app name, or your company name, those values may now be redacted inside the repository URL as well. - Possible UI impact: If this happens, the repository URL may become partially or fully masked. Since the invocation list and parts of the invocation details view rely on that URL, those views may not display correctly for the affected repositories.
Why This Matters
This change improves protection for private repository credentials in Build Cache analytics. At the same time, it makes it more important to keep your Bitrise secret list clean and limited to actual sensitive values. Declaring generic words as secrets can interfere with repository URL rendering in the UI, and in general make debugging issues harder.
Action required: Review your secret environment variables and remove trivial, non-sensitive entries from your secret list. Keeping only real secrets there ensures your repository URL stays intact and the invocation list and invocation details render normally.
Bottom line: Repository URLs in Build Cache analytics are now safer, with embedded Git credentials removed before storage. To avoid UI issues, make sure your Bitrise secrets contain only truly sensitive values.