fix: register SOPS-decrypted secrets for CI log redaction #460

2026-06-05T21:40:57Z

guettlibot commented

2026-06-05 21:40:57 +00:00

(Migrated from codeberg.org)

Summary

The Forgejo/GitHub Actions runner only redacts values it has been explicitly told about. Secrets exported via $GITHUB_ENV in setup_dagger_remote.sh were never registered, so they could appear in plain text in CI log output.
Added ::add-mask:: calls for every secret exported by export_secret(), and for the two inline variables DAGGER_SSH_KEY and DAGGER_ENGINE_HOST that bypass that function.
Multiline values (e.g. SSH private keys, JSON key files) are masked line-by-line, since ::add-mask:: covers a single line at a time.

Test plan

Trigger a workflow_dispatch run of deploy.yml and confirm no secret values appear in plain text in the "Setup Dagger Remote Engine" step or any subsequent steps.
Confirm the existing [secrets] exported NAME (N chars) log lines still appear (they log only the name and length, not the value).

Closes #434

## Summary - The Forgejo/GitHub Actions runner only redacts values it has been explicitly told about. Secrets exported via `$GITHUB_ENV` in `setup_dagger_remote.sh` were never registered, so they could appear in plain text in CI log output. - Added `::add-mask::` calls for every secret exported by `export_secret()`, and for the two inline variables `DAGGER_SSH_KEY` and `DAGGER_ENGINE_HOST` that bypass that function. - Multiline values (e.g. SSH private keys, JSON key files) are masked line-by-line, since `::add-mask::` covers a single line at a time. ## Test plan - [ ] Trigger a `workflow_dispatch` run of `deploy.yml` and confirm no secret values appear in plain text in the "Setup Dagger Remote Engine" step or any subsequent steps. - [ ] Confirm the existing `[secrets] exported NAME (N chars)` log lines still appear (they log only the name and length, not the value). Closes #434

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: guettli/sharedinbox#460