Merge pull request #231 from copenhagentruckwash/fix-exposure-of-private-git-commit-metadata

Redact GitHub commit metadata from public release runtime

services/nginx/app/classes/release_manager.php

@@ -9433,7 +9433,7 @@ class release_manager
             'status' => 'draft',
             'metadata' => [
                 'commit_mode' => $input['commit_mode'],
-                'github_access' => $input['github_access'],
+                'github_access' => self::releaseVersionGithubAccessMetadata($input['github_access'] ?? null),
                 'bundle_member' => true,
             ],
         ]);
@@ -9766,7 +9766,7 @@ class release_manager
             return null;
         }
 
-        $metadata = self::jsonDecode($version['metadata_json'] ?? null);
+        $metadata = self::publicReleaseVersionMetadata(self::jsonDecode($version['metadata_json'] ?? null));
         $commit = $this->versionGithubCommit(['metadata' => $metadata]);
 
         return [
@@ -9789,6 +9789,26 @@ class release_manager
         ];
     }
 
+    private static function publicReleaseVersionMetadata(mixed $metadata): array
+    {
+        if (!is_array($metadata)) {
+            return [];
+        }
+
+        unset($metadata['github_access']);
+        return $metadata;
+    }
+
+    private static function releaseVersionGithubAccessMetadata(mixed $githubAccess): ?array
+    {
+        if (!is_array($githubAccess)) {
+            return null;
+        }
+
+        unset($githubAccess['commit'], $githubAccess['latest_commit'], $githubAccess['commit_authored_at']);
+        return $githubAccess;
+    }
+
     private function publicAssignment(array $assignment): array
     {
         return [

services/nginx/app/tests/Unit/ReleaseManager/ReleaseManagerTest.php

@@ -1357,7 +1357,7 @@ it('resolves release deployment endpoints from manual overrides, URLs, health ch
     ]))->toBe('https://gateway.example.test/beta/frontend');
 });
 
-it('exposes release version git commit metadata for runtime channel cards', function (): void {
+it('redacts GitHub access metadata from public release versions', function (): void {
     $manager = new release_manager();
     $publicVersion = new ReflectionMethod(release_manager::class, 'publicVersion');
     $publicVersion->setAccessible(true);
@@ -1375,20 +1375,29 @@ it('exposes release version git commit metadata for runtime channel cards', func
         'deployed_url' => null,
         'status' => 'active',
         'metadata_json' => json_encode([
+            'commit_mode' => 'specific',
             'github_access' => [
                 'commit' => [
                     'sha' => 'c0ffee0000001111222233334444555566667777',
+                    'message' => 'Private implementation detail',
+                    'author_name' => 'Release Bot',
                     'authored_at' => '2026-05-19T10:15:00Z',
                 ],
+                'commit_authored_at' => '2026-05-19T10:15:00Z',
             ],
+            'bundle_member' => true,
         ]),
         'created_at' => '2026-05-19 10:10:00',
         'deployed_at' => '2026-05-19 10:20:00',
     ]);
 
     expect($version['commit_sha'])->toBe('c0ffee0000001111222233334444555566667777');
-    expect($version['commit']['sha'])->toBe('c0ffee0000001111222233334444555566667777');
-    expect($version['commit_authored_at'])->toBe('2026-05-19T10:15:00Z');
+    expect($version['commit'])->toBeNull();
+    expect($version['commit_authored_at'])->toBeNull();
+    expect($version['metadata'])->toBe([
+        'commit_mode' => 'specific',
+        'bundle_member' => true,
+    ]);
     expect($version['deployed_at'])->toBe('2026-05-19 10:20:00');
 });