From 32786de26267dc8f783114a2471d49e6dda0cdb8 Mon Sep 17 00:00:00 2001 From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com> Date: Fri, 7 Aug 2026 10:58:30 -0400 Subject: [PATCH] fix(scripts): ensure temp GCP SA key cleanup via EXIT trap (SEC-28) (#70) * chore(deps): bump aws-cdk-lib from 2.262.2 to 2.263.0 Bumps [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) from 2.262.2 to 2.263.0. - [Release notes](https://github.com/aws/aws-cdk/releases) - [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md) - [Commits](https://github.com/aws/aws-cdk/commits/v2.263.0/packages/aws-cdk-lib) --- updated-dependencies: - dependency-name: aws-cdk-lib dependency-version: 2.263.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] * chore(deps-dev): bump tsx from 4.23.1 to 4.23.5 Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.1 to 4.23.5. - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.5) --- updated-dependencies: - dependency-name: tsx dependency-version: 4.23.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] * fix: add trap to ensure temp key file removal after GCP SA key creation * fix(scripts): delete temp GCP key before success message * chore(deps): drop cdk-lib and tsx bumps from this PR --------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- scripts/gcp-setup.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/gcp-setup.sh b/scripts/gcp-setup.sh index 0c88c08..d55e32b 100755 --- a/scripts/gcp-setup.sh +++ b/scripts/gcp-setup.sh @@ -102,6 +102,7 @@ echo "Granted objectViewer to $SA_EMAIL." echo "" echo "--- Step 9: Create and store service account key ---" KEY_FILE=$(mktemp) +trap 'rm -f "$KEY_FILE"' EXIT $GCLOUD iam service-accounts keys create "$KEY_FILE" --iam-account="$SA_EMAIL" echo "Service account key created."