fix(ci): Cleanup build logs (#8317)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.github/actions/docker-remote-build/action.yml

@@ -164,11 +164,14 @@ runs:
 
         # Pass AWS credentials as build secrets for sccache S3 access.
         # Dockerfile steps reference these via --mount=type=secret,id=aws-key-id,env=...
+        # Disable tracing to prevent set -x from leaking credentials into logs.
+        set +x
         SECRET_ARGS=""
         if [ "${{ inputs.use_sccache }}" == "true" ] && [ -n "${AWS_ACCESS_KEY_ID:-}" ]; then
           SECRET_ARGS+=" --secret id=aws-key-id,env=AWS_ACCESS_KEY_ID"
           SECRET_ARGS+=" --secret id=aws-secret-id,env=AWS_SECRET_ACCESS_KEY"
         fi
+        set -x
 
         docker buildx build \
           --progress=plain \

container/templates/wheel_builder.Dockerfile

@@ -292,6 +292,8 @@ RUN --mount=type=secret,id=aws-key-id,env=AWS_ACCESS_KEY_ID \
     /tmp/use-sccache.sh show-stats "FFMPEG" && \
     ldconfig && \
     mkdir -p /usr/local/src/ffmpeg && \
+    # Remove build artifacts (config.log, etc.) before preserving the source.
+    find /tmp/ffmpeg-${FFMPEG_VERSION} -name config.log -delete && \
     mv /tmp/ffmpeg-${FFMPEG_VERSION}* /usr/local/src/ffmpeg/
 
 # Build and install UCX