From 408bf581b2be1b3b785b6b323571cc0e160065a0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 14 Nov 2026 09:11:06 +0000
Subject: [PATCH] Service: redact database password in startup log, publish sha
 image tag

The startup banner printed DATABASE_URL verbatim, including the password.
CI now also pushes coverage-service:sha-<commit> so production can pin an
immutable tag.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PS44Q7WRmAzMJLhi44dzdo
---
 .github/workflows/service.yml | 5 ++++-
 service/src/index.ts          | 3 ++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/service.yml b/.github/workflows/service.yml
index 4a8f1c0..75f6958 100644
--- a/.github/workflows/service.yml
+++ b/.github/workflows/service.yml
@@ -104,6 +104,9 @@ jobs:
         with:
           context: service
           push: true
-          tags: ghcr.io/airframesio/coverage-service:latest
+          # The sha tag gives production an immutable reference to pin.
+          tags: |
+            ghcr.io/airframesio/coverage-service:latest
+            ghcr.io/airframesio/coverage-service:sha-${{ github.sha }}
           cache-from: type=gha,scope=service
           cache-to: type=gha,scope=service,mode=max
diff --git a/service/src/index.ts b/service/src/index.ts
index 1ffc87b..d2761e7 100644
--- a/service/src/index.ts
+++ b/service/src/index.ts
@@ -12,7 +12,8 @@ async function main() {
   console.log(`Port: ${config.port}`);
   console.log(`NATS: ${config.natsUrl}`);
   console.log(`Main API: ${config.mainApiUrl}`);
-  console.log(`Database: ${config.databaseUrl}`);
+  // Never log the connection string as is: it carries the database password.
+  console.log(`Database: ${config.databaseUrl.replace(/\/\/([^:@/]+):[^@/]*@/, '//$1:***@')}`);
 
   // 1. Initialize coverage store
   const store = new CoverageStore();