From 2328a9fa9a11cdd81fd37b8102d228c65e3bb9b6 Mon Sep 17 00:00:00 2001 From: Grant Colegate Date: Fri, 20 Feb 2026 12:45:15 +1030 Subject: [PATCH] Surface secret fetch retry warnings in job output The buffer logger passed to secrets.FetchSecrets was never flushed, so retry warnings (HTTP 502, 429, TLS timeouts) were silently swallowed. Steps would appear to hang with no explanation. After FetchSecrets returns, we now iterate the buffer's messages and forward any warnings to the shell logger so they appear in the job log. Fixes A-959 Amp-Thread-ID: https://ampcode.com/threads/T-019c78c7-5821-71f5-a011-2fe9f58b9cb4 Co-authored-by: Amp --- internal/job/executor.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/internal/job/executor.go b/internal/job/executor.go index 2f355bfb92..7cdf032097 100644 --- a/internal/job/executor.go +++ b/internal/job/executor.go @@ -915,8 +915,19 @@ func (e *Executor) fetchAndSetSecrets(ctx context.Context) error { Token: e.shell.Env.GetString("BUILDKITE_AGENT_ACCESS_TOKEN", ""), }) - // Fetch all secrets + // Fetch all secrets. We pass secretLogger (a buffer) here because + // FetchSecrets takes a logger.Logger, but retry warnings within it need + // to reach the user. We flush those from the buffer afterwards. fetchedSecrets, errs := secrets.FetchSecrets(ctx, secretLogger, apiClient, e.JobID, keys, 10) + + // Surface any retry warnings that were buffered during fetching. + // The buffer logger prefixes warn messages with "[warn] ". + for _, msg := range secretLogger.Messages { + if after, ok := strings.CutPrefix(msg, "[warn] "); ok { + e.shell.Warningf("%s", after) + } + } + if len(errs) > 0 { var errorMsg strings.Builder for _, err := range errs {