[security-fix] Security Fix: Remove sensitive key names from secrets validation log messages (Alert #71)

[github-actions]

Security Fix: Clear-Text Logging of Sensitive Information

Alert Number: #71
Severity: High
Rule: go/clear-text-logging
CWE: CWE-312, CWE-315, CWE-359

Vulnerability Description

CodeQL detected a security vulnerability where sensitive data (secret key names) from the secretKeys variable flows through to logging calls in the secrets validation function. While actual secret VALUES were never logged, secret key NAMES (such as "api_token", "deploy_key", "database_password") were being included in log messages, which can expose information about an organization's security infrastructure.

Data Flow Path:

1. secretKeys variable in pkg/workflow/jobs.go:328 contains secret key names
2. These keys are validated in pkg/workflow/compiler_jobs.go:389 via validateSecretsExpression(key, value)
3. The key parameter was logged at pkg/workflow/secrets_validation.go:21 and :24
4. Validation errors flow to pkg/cli/compile_orchestrator.go:586 where they're printed as JSON

Fix Applied

Removed secret key names from log messages in the validateSecretsExpression() function:

Before:

secretsValidationLog.Printf("Invalid secret expression for key %s", key)
secretsValidationLog.Printf("Valid secret expression for key %s", key)

After:

secretsValidationLog.Printf("Invalid secret expression detected")
secretsValidationLog.Printf("Valid secret expression validated")

Security Best Practices Applied

1. Minimal Information Disclosure: Log messages now contain only the minimum necessary information
2. User Feedback Preserved: Error messages returned to users still include the key name (via fmt.Errorf) for debugging, but logs do not
3. Defense in Depth: Even though key names aren't secret values, avoiding their exposure in logs prevents potential information leakage

Testing Considerations

✅ All existing tests pass, including:

• TestValidateSecretsExpression - Core validation logic
• TestValidateSecretsExpressionErrorMessages - Verifies sensitive data NOT in errors
• TestJobsSecretsValidation - End-to-end workflow compilation with secrets
• All other secrets-related tests

✅ Error messages still functional: Users still see helpful error messages with key names via the returned error, just not in logs

✅ No breaking changes: This is a surgical fix that only affects internal logging, not API or user-facing behavior

Impact

This fix eliminates the clear-text logging vulnerability while maintaining all existing functionality. The change is minimal and focused, affecting only two log statements in the secrets validation function.

AI generated by Security Fix PR