Repository: ray-project/ray
File: release/ray_release/custom_byod_build_init_helper.py (Python)

Code before:
        step_name = _get_step_name(image, step_key, custom_image_test_names_map[image])
        env_args = ""
        if runtime_env:
            env_args = " ".join(
                f"--env {k}={v}" for k, v in sorted(runtime_env.items())
            )
        build_cmd_parts = [
            "bazelisk run //release:custom_byod_build --",
            f"--image-name {image}",
            f"--base-image {base_image}",
        ]
        if post_build_script:
            build_cmd_parts.append(f"--post-build-script {post_build_script}")
        if python_depset:
            build_cmd_parts.append(f"--python-depset {python_depset}")
        if env_args:
            build_cmd_parts.append(env_args)
        build_cmd = " ".join(build_cmd_parts)
        step = {
            "label": step_name,
            "key": step_key,
            "instance_type": "release-medium",
            "mount_buildkite_agent": True,
            "commands": [
                f"export RAY_WANT_COMMIT_IN_IMAGE={ray_want_commit}",
                f"bash release/gcloud_docker_login.sh {config['aws2gce_credentials']}",
                "export PATH=$(pwd)/google-cloud-sdk/bin:$$PATH",
                "bash release/azure_docker_login.sh",
                f"az acr login --name {AZURE_REGISTRY_NAME}",
                f"aws ecr get-login-password --region {config['byod_ecr_region']} | docker login --username AWS --password-stdin {config['byod_ecr']}",
                build_cmd,
            ],
        }
        step["depends_on"] = get_prerequisite_step(image, base_image)
        build_config["steps"].append(step)

    with open(destination_file, "w") as f:
        yaml.dump(build_config, f, default_flow_style=False, sort_keys=False)


def get_prerequisite_step(image: str, base_image: str) -> Optional[str]:
    """Get the base image build step for a job that depends on it."""
    config = get_global_config()
    image_repository, _ = image.split(":")
    image_name = image_repository.split("/")[-1]
    if base_image.startswith(ANYSCALE_RAY_IMAGE_PREFIX):
        return "forge"
    if image_name == "ray-ml":
        return config["release_image_step_ray_ml"]
    elif image_name == "ray-llm":
        return config["release_image_step_ray_llm"]

Review comment (security):
could you declare a var for `config['aws2gce_credentials']` so that it does not need to use single quote here?

Code after:
        if not post_build_script and not python_depset and not runtime_env:
            continue
        step_key = generate_custom_build_step_key(image)
        step_name = _get_step_name(image, step_key, custom_image_test_names_map[image])
        env_args = ""
        if runtime_env:
            env_args = " ".join(
                f"--env {k}={v}" for k, v in sorted(runtime_env.items())
            )
        build_cmd_parts = [
            "bazelisk run //release:custom_byod_build --",
            f"--image-name {image}",
            f"--base-image {base_image}",
        ]
        if post_build_script:
            build_cmd_parts.append(f"--post-build-script {post_build_script}")
        if python_depset:
            build_cmd_parts.append(f"--python-depset {python_depset}")
        if env_args:
            build_cmd_parts.append(env_args)
        build_cmd = " ".join(build_cmd_parts)
        step = {
            "label": step_name,
            "key": step_key,
            "instance_type": "release-medium",
            "mount_buildkite_agent": True,
            "commands": [
                f"export RAY_WANT_COMMIT_IN_IMAGE={ray_want_commit}",
                f"bash release/gcloud_docker_login.sh {aws2gce_credentials}",
                "export PATH=$(pwd)/google-cloud-sdk/bin:$$PATH",
                "bash release/azure_docker_login.sh",
                f"az acr login --name {AZURE_REGISTRY_NAME}",
                f"aws ecr get-login-password --region {byod_ecr_region} | docker login --username AWS --password-stdin {byod_ecr}",
                build_cmd,
            ],
        }
        step["depends_on"] = get_prerequisite_step(image, base_image)
        build_config["steps"].append(step)

    with open(destination_file, "w") as f:
        yaml.dump(build_config, f, default_flow_style=False, sort_keys=False)


def get_prerequisite_step(image: str, base_image: str) -> Optional[str]:
    """Get the base image build step for a job that depends on it."""
    config = get_global_config()
    image_repository, _ = image.split(":")
    image_name = image_repository.split("/")[-1]
    if base_image.startswith(ANYSCALE_RAY_IMAGE_PREFIX):
        return "forge"
    if image_name == "ray-ml":