fix: prevent secret tracing in dependency build stages

[QuantumExplorer]

What

• disable shell command tracing in the Drive and rs-dapi dependency stages that consume an optional GitHub credential
• require a non-empty mounted credential before configuring Git authentication
• remove the temporary Git configuration through an exit trap on both successful and failed builds

Why

The affected stages expanded a mounted credential while command tracing was enabled. Raw build output could therefore include credential material even though BuildKit kept the mounted file out of image layers.

This covers PLATFORM-DS-CAND-376.

Checks

• Dockerfile diff and whitespace validation
• synthetic credential output test: marker absent from stdout and stderr
• failure-path cleanup test: temporary Git configuration removed

A Docker build parser check was attempted, but the local Docker daemon is not running.

Summary by CodeRabbit

• Bug Fixes
  • Improved Docker build reliability by enforcing stricter shell error handling.
  • Updated credential cleanup to run automatically when build steps exit.
  • Prevented empty secret files from triggering Git URL rewriting.
  • Simplified build-cache statistics handling while maintaining cleanup safeguards.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9b38c35f-a40a-4945-9a3e-57f0db456416

📥 Commits

Reviewing files that changed from the base of the PR and between fc05d62 and 0389415.

📒 Files selected for processing (1)

• Dockerfile

---

📝 Walkthrough

Walkthrough

The Dockerfile updates shell execution flags and cargo dependency-cache preparation in the build-drive-abci and build-rs-dapi stages, including exit-trap cleanup and non-empty GitHub secret checks.

Changes

Docker build cache shell handling

Layer / File(s)	Summary
Update build-stage shell and cache preparation Dockerfile	Both stages enable Bash pipefail and -e, remove -x tracing, clean ~/.gitconfig through an EXIT trap, and only rewrite GitHub URLs when the secret file is non-empty.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: shumkov

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: reducing secret exposure in dependency build stages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-docker-build-secret-logging

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

🕓 Ready for review — 25 ahead in queue (commit 0389415)
Queue position: 26/27