Summary

The evergreen_api_credentials_configure.sh script writes .evergreen.yml which contains evergreen_api_key directly into the src directory in the current git repo. Any workflow that runs git add could pick up this file and expose it if pushed.

This happened while creating a PR automation bot (SERVER-122442) and resulted in a security incident (INFOSEC-100600).

# evergreen/functions/evergreen_api_credentials_configure.sh
cd src
cat >.evergreen.yml <<END_OF_CREDS
api_server_host: https://evergreen.mongodb.com/api
api_key: "${evergreen_api_key}"
user: "${evergreen_api_user}"
END_OF_CREDS