[JENKINS-63254][JENKINS-47101] add watch variables to EnvironmentExpander

src/main/java/org/jenkinsci/plugins/workflow/steps/EnvironmentExpander.java

@@ -29,10 +29,14 @@
 import hudson.model.Computer;
 import hudson.model.Run;
 import hudson.model.TaskListener;
+
 import java.io.IOException;
 import java.io.Serializable;
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Map;
+import java.util.Set;
 import javax.annotation.CheckForNull;
 import javax.annotation.Nonnull;
 
@@ -48,6 +52,16 @@ public abstract class EnvironmentExpander implements Serializable {
      */
     public abstract void expand(@Nonnull EnvVars env) throws IOException, InterruptedException;
 
+    /**
+     * Get the names of environment variables known to contain sensitive values, such as secrets, in the current context.
+     * Should be overridden by subclasses that bind secret values to environment variables.
+     *
+     * @return a set of environment variables known to contain sensitive values
+     */
+    public @Nonnull Set<String> getSensitiveVariables() {
+        return Collections.emptySet();
+    }
+
     /**
      * Provides an expander for a constant map of string keys and string values. Supports {@link EnvVars#override(String, String)}
      * behavior, such as {@code PATH+XYZ} overrides.
@@ -92,10 +106,25 @@ private static class MergedEnvironmentExpander extends EnvironmentExpander {
             this.original = original;
             this.subsequent = subsequent;
         }
+
         @Override public void expand(EnvVars env) throws IOException, InterruptedException {
             original.expand(env);
             subsequent.expand(env);
         }
+
+        @Override
+        public Set<String> getSensitiveVariables() {
+            Set<String> originalSensitive = original.getSensitiveVariables();
+            Set<String> subsequentSensitive = subsequent.getSensitiveVariables();
+            if (originalSensitive.isEmpty() && subsequentSensitive.isEmpty()) {
+                return Collections.emptySet();
+            } else {
+                Set<String> mergedWatch = new HashSet<>();
+                mergedWatch.addAll(originalSensitive);
+                mergedWatch.addAll(subsequentSensitive);
+                return mergedWatch;
+            }
+        }
     }
 
     /**
@@ -142,5 +171,4 @@ private static class MergedEnvironmentExpander extends EnvironmentExpander {
         }
         return env;
     }
-
 }