|
19 | 19 | from pipelines.airbyte_ci.connectors.context import ConnectorContext |
20 | 20 |
|
21 | 21 |
|
22 | | -async def get_secrets_to_mask(ci_credentials_with_downloaded_secrets: Container) -> list[str]: |
| 22 | +# List of overrides for the secrets masking logic. |
| 23 | +# These keywords may have been marked as secrets, perhaps somewhat aggressively. |
| 24 | +# Masking them, however, is annoying and pointless. |
| 25 | +# This list should be extended (carefully) as needed. |
| 26 | +NOT_REALLY_SECRETS = { |
| 27 | + "admin", |
| 28 | + "airbyte", |
| 29 | + "host", |
| 30 | +} |
| 31 | + |
| 32 | + |
| 33 | +async def get_secrets_to_mask(ci_credentials_with_downloaded_secrets: Container, connector_technical_name: str) -> list[str]: |
23 | 34 | """This function will print the secrets to mask in the GitHub actions logs with the ::add-mask:: prefix. |
24 | 35 | We're not doing it directly from the ci_credentials tool because its stdout is wrapped around the dagger logger, |
25 | 36 | And GHA will only interpret lines starting with ::add-mask:: as secrets to mask. |
26 | 37 | """ |
27 | 38 | secrets_to_mask = [] |
28 | 39 | if secrets_to_mask_file := await get_file_contents(ci_credentials_with_downloaded_secrets, "/tmp/secrets_to_mask.txt"): |
29 | 40 | for secret_to_mask in secrets_to_mask_file.splitlines(): |
| 41 | + if secret_to_mask in NOT_REALLY_SECRETS or secret_to_mask in connector_technical_name: |
| 42 | + # Don't mask secrets which are also common words or connector name. |
| 43 | + continue |
30 | 44 | # We print directly to stdout because the GHA runner will mask only if the log line starts with "::add-mask::" |
31 | 45 | # If we use the dagger logger, or context logger, the log line will start with other stuff and will not be masked |
32 | 46 | print(f"::add-mask::{secret_to_mask}") |
@@ -59,7 +73,7 @@ async def download(context: ConnectorContext, gcp_gsm_env_variable_name: str = " |
59 | 73 | ) |
60 | 74 | # We don't want to print secrets in the logs when running locally. |
61 | 75 | if context.is_ci: |
62 | | - context.secrets_to_mask = await get_secrets_to_mask(with_downloaded_secrets) |
| 76 | + context.secrets_to_mask = await get_secrets_to_mask(with_downloaded_secrets, context.connector.technical_name) |
63 | 77 | connector_secrets = {} |
64 | 78 | for secret_file in await with_downloaded_secrets.directory(secrets_path).entries(): |
65 | 79 | secret_plaintext = await with_downloaded_secrets.directory(secrets_path).file(secret_file).contents() |
|
0 commit comments