[intel352]

Summary

• replace broad :// safe-ref detection with an explicit Signal/Workflow ref scheme allowlist
• add regressions for scheme-shaped raw credential material in service submit and service operation outputs
• bump release metadata to v0.14.1

Verification

• go test ./internal -run 'ServiceLiveSubmitOutputRedactsRawInputs|ServiceOperationPrepareBuildsEnvelopeWithoutSubmit' -count=1 failed before the fix with foo://credential-raw-secret leaks\n- go test ./internal -run 'ServiceLiveSubmitOutputRedactsRawInputs|ServiceOperationPrepareBuildsEnvelopeWithoutSubmit|ServiceOperationReportsAndAuditAreRedacted' -count=1\n- go test ./... -count=1\n- make pipeline-test\n- wfctl plugin validate-contract --for-publish --tag v0.14.1 .\n- goreleaser check\n- git diff --check

[Copilot]

Pull request overview

This PR tightens redaction of Signal/Workflow reference-like strings by replacing the previous “contains ://” heuristic with an explicit allowlist of known-safe ref schemes, and adds regressions to ensure scheme-shaped raw credential material is not echoed in service submit and operation outputs. It also bumps release metadata to v0.14.1.

Changes:

• Replace broad :// safe-ref detection with an explicit Signal/Workflow scheme allowlist (safeSignalRef → isAllowedSignalRef).
• Add/adjust tests to ensure foo://credential-raw-secret (and the raw fragment) are not present in marshaled outputs and that credential refs are redacted where expected.
• Bump plugin/release metadata from 0.14.0 to 0.14.1.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
plugin.json	Bumps plugin version and release asset URLs to v0.14.1.
Makefile	Updates VERSION to 0.14.1 for builds/tests/releases.
internal/steps_service_operations_test.go	Adds regression assertions ensuring operation outputs redact scheme-shaped raw credentials.
internal/service_transport.go	Implements explicit allowlist-based ref scheme validation for redaction decisions.
internal/service_transport_test.go	Extends submit output redaction regression to cover scheme-shaped raw credential material.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.