mirror of
https://github.com/go-task/task.git
synced 2026-06-29 15:44:30 +00:00
da90ecd083
- mask secret values in `task --summary` (commands and vars listing) - mask resolved value of dynamic (sh) secrets in verbose logs - use masked command for platform-skipped verbose log - allow `secret` key in any position in a var definition (not only first) - add `value` to the JSON schema var definition - skip masking pass when no secret is present and dedup mask helpers - document that the `secret` flag is not propagated to derived variables
84 lines
2.3 KiB
YAML
84 lines
2.3 KiB
YAML
version: '3'
|
|
|
|
vars:
|
|
# Public variable
|
|
APP_NAME: myapp
|
|
|
|
# Secret variable with value
|
|
API_KEY:
|
|
value: "secret-api-key-123"
|
|
secret: true
|
|
|
|
# Secret variable from shell command
|
|
PASSWORD:
|
|
sh: "echo 'my-super-secret-password'"
|
|
secret: true
|
|
|
|
# Non-secret variable
|
|
PUBLIC_URL: https://example.com
|
|
|
|
tasks:
|
|
test-secret-masking:
|
|
desc: Test that secret variables are masked in logs
|
|
cmds:
|
|
- echo "Deploying {{.APP_NAME}} to {{.PUBLIC_URL}}"
|
|
- echo "Using API key {{.API_KEY}}"
|
|
- echo "Password is {{.PASSWORD}}"
|
|
- echo "Public app name is {{.APP_NAME}}"
|
|
|
|
test-multiple-secrets:
|
|
desc: Test multiple secrets in one command
|
|
cmds:
|
|
- echo "API={{.API_KEY}} PWD={{.PASSWORD}}"
|
|
|
|
test-mixed:
|
|
desc: Test mix of secret and public vars
|
|
vars:
|
|
LOCAL_SECRET:
|
|
value: "task-level-secret"
|
|
secret: true
|
|
cmds:
|
|
- echo "App={{.APP_NAME}} Secret={{.LOCAL_SECRET}} URL={{.PUBLIC_URL}}"
|
|
|
|
test-deferred-secret:
|
|
desc: Test that deferred commands mask secrets
|
|
vars:
|
|
DEFERRED_SECRET:
|
|
value: "deferred-secret-value"
|
|
secret: true
|
|
cmds:
|
|
- echo "Starting task"
|
|
- defer: echo "Cleanup with secret={{.DEFERRED_SECRET}} and app={{.APP_NAME}}"
|
|
- echo "Main command executed"
|
|
|
|
test-dynamic-secret-verbose:
|
|
desc: Test that dynamic (sh) secrets are masked even in verbose logs
|
|
cmds:
|
|
- echo "Password is {{.PASSWORD}}"
|
|
|
|
test-secret-key-order:
|
|
desc: Test that "secret" may be declared before the value/sh key
|
|
vars:
|
|
SECRET_FIRST:
|
|
secret: true
|
|
value: "order-independent-secret"
|
|
SH_SECRET_FIRST:
|
|
secret: true
|
|
sh: "echo 'sh-order-independent-secret'"
|
|
cmds:
|
|
- echo "Value={{.SECRET_FIRST}} Sh={{.SH_SECRET_FIRST}}"
|
|
|
|
test-env-secret-limitation:
|
|
desc: Test showing that env vars with secret flag are NOT masked (limitation)
|
|
env:
|
|
SECRET_TOKEN:
|
|
value: "env-secret-token-123"
|
|
secret: true
|
|
PUBLIC_ENV: "public-value"
|
|
cmds:
|
|
# Templates {{.VAR}} don't work with env - they're empty
|
|
- echo "Token via template is {{.SECRET_TOKEN}}"
|
|
# Shell $VAR works but is NOT masked (env vars not in template system)
|
|
- echo "Token via shell is $SECRET_TOKEN"
|
|
- echo "Public env is {{.PUBLIC_ENV}}"
|