vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Mask secret values in the log as it is written

e82bbe7ddc584dc54ee57c7ce3b97f933c9e9886 · Keenan Nemetz · 7d ago · parent 4ac42680

Mask secret values in the log as it is written

A step that prints a secret by accident used to put it in the attempt log, and
the log is streamed to the instance and kept. The runner now replaces every
value it was given with *** before the bytes reach the log file, so the copy
the server stores never holds one and a value split across two writes is still
caught: the mask holds back the last longest-1 bytes and the runner flushes at
the end of each step.

ci/redact is the one implementation, so a local `vole workflow run` masks its
terminal output the same way. Its own error text goes through the same mask,
because "the runtime message does not contain a value" should be true rather
than assumed.

It is best effort, and the docs say where it stops: a re-encoded value does not
match, a value shorter than four bytes is left alone because masking every
occurrence of it would rewrite the log, and an artifact or a site file is
published exactly as the step wrote it.

Slice 3 of #154.

server/secret_test.go +6−2

@@ -262,6 +262,7 @@ jobs:
	262	262	secrets: [DEPLOY_TOKEN, NOT_SET]
	263	263	steps:
	264	264	- run: printf 'length=%s newlines=%s missing=%s\n' "${#DEPLOY_TOKEN}" "$(printf %s "$DEPLOY_TOKEN" \| wc -l)" "${NOT_SET-unset}"
		265	- run: printf 'echoed=%s\n' "$DEPLOY_TOKEN"
	265	266	`))
	266	267	if _, errs, err := f.git(work, "push", f.sshURL(f.repo), "main:refs/heads/main"); err != nil {
	267	268	t.Fatalf("push: %s", errs)
@@ -286,13 +287,16 @@ jobs:
	286	287	for _, want := range []string{
	287	288	"length=18 newlines=1 missing=unset",
	288	289	"NOT_SET is not set for this repository, so this job runs without it.",
		290	// The step prints the value on purpose: the log has to show the placeholder,
		291	// including for the line break inside it.
		292	"echoed=***",
	289	293	} {
	290	294	if !strings.Contains(log, want) {
	291	295	t.Fatalf("the log has no %q:\n%s", want, log)
	292	296	}
	293	297	}
	294		// The value reaches the step and not the log: the step prints its length, never
	295		// the value, and a run record names the version rather than the value.
		298	// The value reaches the step and not the log, even when the step prints it, and a
		299	// run record names the version rather than the value.
	296	300	if strings.Contains(log, "s3cret") \|\| strings.Contains(log, "second line") {
	297	301	t.Fatalf("the log holds a value:\n%s", log)
	298	302	}