Secrets are printed in logs

[rahfar]

Hi,

Noticed that in dry mode secrets are printed in logs (actualy without dry also)

> spot --dry --secrets.provider=spot --secrets.key=1
spot latest
dry run - no changes will be made and no commands will be executed
[12377.ru:22] run task "backup", commands: 3
[12377.ru:22] completed command "daily" {script: /bin/sh -c 'AWS_ACCESS_KEY_ID="123"; AWS_SECRET_ACCESS_KEY="123"; DISCORD_WEBHOOK_URL="https://discord.com/api/webhooks/123"; s3cmd --no-progress --storage-class=COLD sync /path s3://bucket'} (0s)

playbook

user: root
ssh_key: ~/.ssh/id_rsa
ssh_shell: /bin/bash
local_shell: /bin/bash

tasks:
  - name: backup
    on_error: 'curl -X POST -H "Content-Type:application/json" --data "{\"content\": \"backup upload unsuccessfull. Pls check logs\"}" $DISCORD_WEBHOOK_URL'
    targets: ["example.com"]
    options:
      secrets: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "DISCORD_WEBHOOK_URL"]
    commands:
      - name: daily
        script: s3cmd --no-progress --storage-class=COLD sync /path s3://bucket

[umputun]

Good catch, thanks for the report. The issue was related to how a single-line, colorized logger's Printf handled secrets. The fix is now on the master branch and has been covered with additional tests. Let me know if everything looks good in your tests.

[rahfar]

Super, my test cases are now working as expected, thanks!