fix(ci): reject unknown job names in github-custom-job-secrets

Author: shaanmajid

book/src/reference/config.md

@@ -1491,6 +1491,7 @@ Allows you to customize the secrets passed to your custom CI jobs.
 
 Jobs not present in this map keep the legacy `secrets: inherit` behavior.
 If a configured job has an empty list/map, `secrets` is omitted entirely for that job.
+Unknown job names in this map are an error.
 
 You can use either:
 

cargo-dist/src/backend/ci/github.rs

@@ -296,6 +296,8 @@ impl GithubCiInfo {
         let mut job_permissions = ci_config.permissions.clone();
         let job_secrets = ci_config.secrets.clone();
         let configured_secret_jobs = &ci_config.configured_secret_jobs;
+        let known_custom_jobs = collect_custom_job_names(ci_config);
+        validate_job_secret_config_keys(configured_secret_jobs, &known_custom_jobs)?;
         // user publish jobs default to elevated privileges
         for JobStyle::User(name) in &ci_config.publish_jobs {
             job_permissions.entry(name.clone()).or_insert_with(|| {
@@ -623,6 +625,41 @@ fn build_jobs(
     Ok(output)
 }
 
+fn collect_custom_job_names(ci_config: &GithubCiConfig) -> SortedSet<String> {
+    ci_config
+        .plan_jobs
+        .iter()
+        .chain(ci_config.build_local_jobs.iter())
+        .chain(ci_config.build_global_jobs.iter())
+        .chain(ci_config.host_jobs.iter())
+        .chain(ci_config.publish_jobs.iter())
+        .chain(ci_config.post_announce_jobs.iter())
+        .filter_map(|job| match job {
+            JobStyle::User(name) => Some(name.clone()),
+        })
+        .collect()
+}
+
+fn validate_job_secret_config_keys(
+    configured_secret_jobs: &SortedSet<String>,
+    known_custom_jobs: &SortedSet<String>,
+) -> DistResult<()> {
+    let unknown_jobs = configured_secret_jobs
+        .iter()
+        .filter(|job_name| !known_custom_jobs.contains(*job_name))
+        .cloned()
+        .collect::<Vec<_>>();
+
+    if unknown_jobs.is_empty() {
+        return Ok(());
+    }
+
+    Err(DistError::GithubUnknownCustomJobSecrets {
+        jobs: unknown_jobs,
+        known_jobs: known_custom_jobs.iter().cloned().collect(),
+    })
+}
+
 /// Get the best `cache-provider` key to use for <https://github.com/Swatinem/rust-cache>.
 ///
 /// In the future we might make "None" here be a way to say "disable the cache".
@@ -1083,19 +1120,18 @@ mod tests {
     use super::*;
 
     #[test]
-    fn build_jobs_ignores_unknown_secret_config_keys() {
-        let jobs = vec![JobStyle::User("known-job".to_owned())];
-        let perms = SortedMap::new();
-        let secrets = SortedMap::from_iter([(
-            "unknown-job".to_owned(),
-            SortedMap::from_iter([("TOKEN".to_owned(), "TOKEN".to_owned())]),
-        )]);
+    fn validate_job_secret_config_keys_rejects_unknown_jobs() {
         let configured_secret_jobs = SortedSet::from_iter(["unknown-job".to_owned()]);
+        let known_custom_jobs = SortedSet::from_iter(["known-job".to_owned()]);
 
-        let built = build_jobs(&jobs, &perms, &secrets, &configured_secret_jobs).unwrap();
-        assert_eq!(built.len(), 1);
-        assert_eq!(built[0].name, "known-job");
-        assert!(built[0].secrets.is_none());
+        let err = validate_job_secret_config_keys(&configured_secret_jobs, &known_custom_jobs)
+            .expect_err("unknown job keys should fail closed");
+
+        let DistError::GithubUnknownCustomJobSecrets { jobs, known_jobs } = err else {
+            panic!("expected GithubUnknownCustomJobSecrets");
+        };
+        assert_eq!(jobs, vec!["unknown-job".to_owned()]);
+        assert_eq!(known_jobs, vec!["known-job".to_owned()]);
     }
 
     #[test]

cargo-dist/src/errors.rs

@@ -465,6 +465,20 @@ pub enum DistError {
         levels: Vec<String>,
     },
 
+    /// Unknown custom job key specified in GitHub custom job secrets config
+    #[error(
+        "One or more github-custom-job-secrets entries didn't match configured custom jobs: {jobs:?}"
+    )]
+    #[diagnostic(help(
+        "Configured custom jobs are: {known_jobs:?}. Make sure each key matches a job name (without leading './') from plan-jobs, local-artifacts-jobs, global-artifacts-jobs, host-jobs, publish-jobs, or post-announce-jobs."
+    ))]
+    GithubUnknownCustomJobSecrets {
+        /// Unknown custom job keys from github-custom-job-secrets
+        jobs: Vec<String>,
+        /// Known custom job names from configured job lists
+        known_jobs: Vec<String>,
+    },
+
     /// An unknown target was found
     #[error("Unrecognized target: {target}")]
     #[diagnostic(help("The full list of supported targets can be found here: https://axodotdev.github.io/cargo-dist/book/reference/config.html#targets"))]

cargo-dist/tests/integration-tests.rs

@@ -589,7 +589,6 @@ plan-list = ["PLAN_TOKEN"]
 local-empty-list = []
 host-list-multi = ["CLOUDFLARE_API_TOKEN", "DEPLOY_KEY"]
 post-list = ["POST_TOKEN"]
-unknown-job = ["SHOULD_BE_IGNORED"]
 
 [workspace.metadata.dist.github-custom-job-secrets.local-map]
 DEPLOY_TOKEN = "ORG_DEPLOY_TOKEN"