From 96984e3033a084eac887a02e7c86d3b58c75b7f0 Mon Sep 17 00:00:00 2001
From: Andrew Kelley <andrew@ziglang.org>
Date: Sun, 3 Nov 2019 14:55:09 -0500
Subject: [PATCH] ci: avoid leaking oauth access token

---
 .builds/freebsd.yml        | 2 +-
 ci/azure/on_master_success | 4 +++-
 ci/azure/pipelines.yml     | 2 +-
 ci/drone/linux_script      | 3 +++
 ci/srht/freebsd_script     | 3 +++
 ci/srht/on_master_success  | 4 +++-
 6 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.builds/freebsd.yml b/.builds/freebsd.yml
index 16db3a967880b35f32112b0b5b752167b2cb5aff..95712e4995cf0ab334c530eba18cab3eccb78e8b 100644
--- a/.builds/freebsd.yml
+++ b/.builds/freebsd.yml
@@ -7,7 +7,7 @@ packages:
   - jq
 secrets:
   - 6c60aaee-92e7-4e7d-812c-114817689b4d
-  - 2cd8c203-ba06-4504-be49-1e2b9b71efdd
+  - dd0bd962-7664-4d3e-b0f3-41c9ee96b8b8
 sources:
   - https://github.com/ziglang/zig
 tasks:
diff --git a/ci/azure/on_master_success b/ci/azure/on_master_success
index 5354fb0655670a932261520c0ad2027d0e762a68..cef618361bbc5554f5e5a99702cbd89dc07f8035 100755
--- a/ci/azure/on_master_success
+++ b/ci/azure/on_master_success
@@ -1,6 +1,8 @@
 #!/bin/sh
 
-set -x
+# We do not set -x because this would leak the oauth access token.
+set +x
+
 set -e
 
 sudo apt-get update -y
diff --git a/ci/azure/pipelines.yml b/ci/azure/pipelines.yml
index 8ce9d8d01f7863bf37a391ab173cac64ad568456..d2cd30cc7c7715a58a488ad2be44e03273449fb6 100644
--- a/ci/azure/pipelines.yml
+++ b/ci/azure/pipelines.yml
@@ -44,7 +44,7 @@ jobs:
   - script: ci/azure/windows_script.bat
     name: main
     displayName: 'Build and test'
-- job: UpdateDownloadPage
+- job: OnMasterSuccess
   dependsOn:
   - BuildMacOS
   - BuildLinux
diff --git a/ci/drone/linux_script b/ci/drone/linux_script
index 03bf0a3e5659a222db50b902f9d7a4b6625e40fc..7db505474df837049cbaefb653a476b7ecd03f4b 100755
--- a/ci/drone/linux_script
+++ b/ci/drone/linux_script
@@ -61,6 +61,9 @@ if [ -z "$DRONE_PULL_REQUEST" ]; then
   s3cmd put -P --add-header="Cache-Control: max-age=0, must-revalidate" "$JSONFILE" "s3://ziglang.org/builds/$JSONFILE"
   s3cmd put -P "$JSONFILE" "s3://ziglang.org/builds/$TRIPLEARCH-linux-$VERSION.json"
   if [ "$GITBRANCH" = "master" ]; then 
+    # avoid leaking oauth token
+    set +x
+
     cd "$BUILDDIR"
     ./ci/srht/on_master_success "$VERSION" "$SRHT_OAUTH_TOKEN"
   fi
diff --git a/ci/srht/freebsd_script b/ci/srht/freebsd_script
index 8e717e4ba6bf555c5203ad102dde319225c11fe6..a2f4431d7473d72989cd2f503d45ffa522f885ef 100755
--- a/ci/srht/freebsd_script
+++ b/ci/srht/freebsd_script
@@ -88,6 +88,9 @@ if [ -f ~/.s3cfg ]; then
   s3cmd put -P "$JSONFILE" "s3://ziglang.org/builds/x86_64-freebsd-$VERSION.json"
 
   if [ "$GITBRANCH" = "master" ]; then 
+    # avoid leaking oauth token
+    set +x
+
     OAUTH_TOKEN="$(cat ~/.oauth_token)"
     cd "$ZIGDIR"
     ./ci/srht/on_master_success "$VERSION" "$OAUTH_TOKEN"
diff --git a/ci/srht/on_master_success b/ci/srht/on_master_success
index 7638ec70d819e4e2f697835394f80a1480ebb29a..a42e63c8096f9b63fd154da626faf82b74ce823d 100755
--- a/ci/srht/on_master_success
+++ b/ci/srht/on_master_success
@@ -6,7 +6,9 @@
 # * jq
 # * cat
 
-set -x
+# We do not set -x because this would leak the oauth access token.
+set +x
+
 set -e
 
 VERSION="$1"
-- 
2.54.0