fix: use os.Getenv for CI_JOB_TOKEN to avoid persisting it in attestations

CI_JOB_TOKEN is sensitive and should not be included in the envVars
map that gets persisted in attestations. Read it directly via
os.Getenv instead, while keeping the other non-sensitive reviewer
env vars (CI_PROJECT_PATH, CI_MERGE_REQUEST_PROJECT_PATH) in
ListEnvVars.

Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Author: jiparis

pkg/attestation/crafter/prmetadata.go

@@ -169,7 +169,8 @@ func extractGitLabMRMetadata(ctx context.Context, envVars map[string]string) (bo
 	if projectPath == "" {
 		projectPath = envVars["CI_PROJECT_PATH"]
 	}
-	reviewers := fetchGitLabReviewers(ctx, envVars["CI_SERVER_URL"], projectPath, mrIID, envVars["CI_JOB_TOKEN"])
+	// CI_JOB_TOKEN is read via os.Getenv to avoid persisting it in the attestation envVars map.
+	reviewers := fetchGitLabReviewers(ctx, envVars["CI_SERVER_URL"], projectPath, mrIID, os.Getenv("CI_JOB_TOKEN"))
 
 	metadata := &PRMetadata{
 		Platform:     "gitlab",

pkg/attestation/crafter/prmetadata_test.go

@@ -323,9 +323,11 @@ func TestExtractGitLabMRMetadataWithReviewers(t *testing.T) {
 		"CI_MERGE_REQUEST_TARGET_BRANCH_NAME": "main",
 		"CI_SERVER_URL":                       server.URL,
 		"CI_MERGE_REQUEST_PROJECT_PATH":       "group/project",
-		"CI_JOB_TOKEN":                        "test-token",
 	}
 
+	// CI_JOB_TOKEN is read via os.Getenv (not from envVars) to avoid persisting it in attestations.
+	t.Setenv("CI_JOB_TOKEN", "test-token")
+
 	isMR, metadata, err := extractGitLabMRMetadata(context.Background(), envVars)
 	require.NoError(t, err)
 	require.True(t, isMR)

pkg/attestation/crafter/runners/daggerpipeline.go

@@ -71,7 +71,6 @@ func (r *DaggerPipeline) ListEnvVars() []*EnvVarDefinition {
 		{"CI_MERGE_REQUEST_PROJECT_PATH", true},
 		{"CI_SERVER_URL", true},
 		{"CI_PROJECT_PATH", true},
-		{"CI_JOB_TOKEN", true},
 		{"GITLAB_USER_LOGIN", true},
 	}
 }

pkg/attestation/crafter/runners/daggerpipeline_test.go

@@ -81,7 +81,6 @@ func (s *daggerPipelineSuite) TestListEnvVars() {
 		{"CI_MERGE_REQUEST_PROJECT_PATH", true},
 		{"CI_SERVER_URL", true},
 		{"CI_PROJECT_PATH", true},
-		{"CI_JOB_TOKEN", true},
 		{"GITLAB_USER_LOGIN", true},
 	}
 	assert.Equal(s.T(), expected, s.runner.ListEnvVars())

pkg/attestation/crafter/runners/gitlabpipeline.go

@@ -79,7 +79,6 @@ func (r *GitlabPipeline) ListEnvVars() []*EnvVarDefinition {
 		{"CI_RUNNER_DESCRIPTION", true},
 		{"CI_COMMIT_REF_NAME", false},
 		{"CI_PROJECT_PATH", false},
-		{"CI_JOB_TOKEN", true},
 		// MR-specific variables (optional - only present in MR contexts)
 		{"CI_PIPELINE_SOURCE", true},
 		{"CI_MERGE_REQUEST_IID", true},

pkg/attestation/crafter/runners/gitlabpipeline_test.go

@@ -92,7 +92,6 @@ func (s *gitlabPipelineSuite) TestListEnvVars() {
 		{"CI_RUNNER_DESCRIPTION", true},
 		{"CI_COMMIT_REF_NAME", false},
 		{"CI_PROJECT_PATH", false},
-		{"CI_JOB_TOKEN", true},
 		{"CI_PIPELINE_SOURCE", true},
 		{"CI_MERGE_REQUEST_IID", true},
 		{"CI_MERGE_REQUEST_TITLE", true},
@@ -119,7 +118,6 @@ func (s *gitlabPipelineSuite) TestResolveEnvVars() {
 		"CI_COMMIT_REF_NAME":                  "main",
 		"CI_SERVER_URL":                       "https://gitlab.com",
 		"CI_PROJECT_PATH":                     "chainloop/chainloop",
-		"CI_JOB_TOKEN":                        "gitlab-job-token",
 		"CI_PIPELINE_SOURCE":                  "merge_request_event",
 		"CI_MERGE_REQUEST_IID":                "42",
 		"CI_MERGE_REQUEST_TITLE":              "Add new feature",
@@ -142,7 +140,6 @@ func (s *gitlabPipelineSuite) TestResolveEnvVarsWithoutRunnerDescription() {
 	s.T().Setenv("CI_MERGE_REQUEST_TARGET_BRANCH_NAME", "")
 	s.T().Setenv("CI_MERGE_REQUEST_PROJECT_URL", "")
 	s.T().Setenv("CI_MERGE_REQUEST_PROJECT_PATH", "")
-	s.T().Setenv("CI_JOB_TOKEN", "")
 
 	resolvedEnvVars, errors := s.runner.ResolveEnvVars()
 	s.Empty(errors, "Should not error when optional variables are missing")
@@ -194,7 +191,6 @@ func (s *gitlabPipelineSuite) SetupTest() {
 	t.Setenv("CI_MERGE_REQUEST_TARGET_BRANCH_NAME", "main")
 	t.Setenv("CI_MERGE_REQUEST_PROJECT_URL", "https://gitlab.com/chainloop/chainloop/-/merge_requests/42")
 	t.Setenv("CI_PROJECT_PATH", "chainloop/chainloop")
-	t.Setenv("CI_JOB_TOKEN", "gitlab-job-token")
 	t.Setenv("CI_MERGE_REQUEST_PROJECT_PATH", "chainloop/chainloop")
 }