-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use consistent secret scrubbing #10006
Conversation
Thank you for your pull request! We could not find a changelog entry for this change. For details on how to document a change, see the contributing guide. |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #10006 +/- ##
==========================================
- Coverage 88.17% 88.14% -0.03%
==========================================
Files 181 181
Lines 22614 22631 +17
==========================================
+ Hits 19939 19949 +10
- Misses 2675 2682 +7
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
resolves #9987
Problem
Secrets are not consistently redacted as
*****
and sometimes show up as$$$DBT_SECRET_START$$$DBT_ENV_SECRET_MINE$$$DBT_SECRET_END$$$
Solution
Change the log function to redact the secret in the same way as we do elsewhere in logs.
To avoid circular dependencies, I moved
SECRET_PLACEHOLDER
intoconstant.py
. I also removedSECRET_ENV_PREFIX
in favor of the one defined indbt-common
to avoid having to keep them in sync with each other and risk anything out of sync unexpecedly.Checklist