Redact runtime switch logs

Author: Pigbibi

.github/workflows/manual-strategy-switch.yml

@@ -297,8 +297,7 @@ jobs:
       - name: Preview assignments
         run: |
           set -euo pipefail
-          python3 scripts/runtime_settings.py render "${TARGET_FILE}" --format env
-          python3 scripts/runtime_settings.py render "${TARGET_FILE}" --format json > "${RUNNER_TEMP}/assignments.json"
+          python3 scripts/runtime_settings.py render "${TARGET_FILE}" --format json --redact-values > "${RUNNER_TEMP}/assignments.json"
           python - <<'PY' "${TARGET_FILE}" "${RUNNER_TEMP}/assignments.json" >> "$GITHUB_STEP_SUMMARY"
           import json
           import sys
@@ -307,20 +306,20 @@ jobs:
           assignments = json.load(open(sys.argv[2], encoding="utf-8"))
           print("## Runtime switch preview")
           print()
-          print(f"- target_id: `{target['target_id']}`")
-          print(f"- repository: `{target['github']['repository']}`")
+          print(f"- platform: `{target['runtime_target']['platform_id']}`")
+          print("- target_id: `<redacted>`")
+          print("- repository: `<redacted>`")
           print(f"- variable_scope: `{target['github']['variable_scope']}`")
           if target["github"].get("environment"):
-              print(f"- environment: `{target['github']['environment']}`")
-          print(f"- strategy_profile: `{target['runtime_target']['strategy_profile']}`")
-          print(f"- service_name: `{target['runtime_target']['service_name']}`")
+              print("- environment: `<redacted>`")
+          print("- strategy_profile: `<redacted>`")
+          print("- service_name: `<redacted>`")
           print(f"- execution_mode: `{target['runtime_target']['execution_mode']}`")
+          print("- values: `<redacted>`")
           print()
           print("### Variables")
           for assignment in assignments:
-              value = str(assignment["value"])
-              preview = value if len(value) <= 220 else value[:220] + "..."
-              print(f"- `{assignment['name']}` = `{preview}`")
+              print(f"- `{assignment['name']}` = `{assignment['value']}`")
           PY
 
       - name: Apply GitHub variable updates

scripts/runtime_settings.py

@@ -63,14 +63,38 @@ class Assignment:
     name: str
     value: str
 
-    def gh_command(self) -> list[str]:
-        command = ["gh", "variable", "set", self.name, "--repo", self.repository, "--body", self.value]
+    def gh_command(self, *, redact_body: bool = False, redact_metadata: bool = False) -> list[str]:
+        body = redacted_value() if redact_body else self.value
+        repository = redacted_value() if redact_metadata else self.repository
+        command = ["gh", "variable", "set", self.name, "--repo", repository, "--body", body]
         if self.variable_scope == "environment":
-            command.extend(["--env", self.environment or ""])
+            environment = redacted_value() if redact_metadata else (self.environment or "")
+            command.extend(["--env", environment])
         return command
 
-    def shell_command(self) -> str:
-        return " ".join(shlex.quote(part) for part in self.gh_command())
+    def shell_command(self, *, redact_body: bool = False, redact_metadata: bool = False) -> str:
+        return " ".join(
+            shlex.quote(part)
+            for part in self.gh_command(redact_body=redact_body, redact_metadata=redact_metadata)
+        )
+
+
+def redacted_value() -> str:
+    return "<redacted>"
+
+
+def assignment_payload(assignment: Assignment, *, redact_values: bool = False) -> dict[str, Any]:
+    payload = {
+        "target_id": assignment.target_id,
+        "repository": assignment.repository,
+        "variable_scope": assignment.variable_scope,
+        "environment": assignment.environment,
+        "name": assignment.name,
+        "value": redacted_value() if redact_values else assignment.value,
+    }
+    if redact_values:
+        payload["value_redacted"] = True
+    return payload
 
 
 def compact_json(value: Any) -> str:
@@ -482,14 +506,7 @@ def command_render(args: argparse.Namespace) -> int:
         print(
             json.dumps(
                 [
-                    {
-                        "target_id": assignment.target_id,
-                        "repository": assignment.repository,
-                        "variable_scope": assignment.variable_scope,
-                        "environment": assignment.environment,
-                        "name": assignment.name,
-                        "value": assignment.value,
-                    }
+                    assignment_payload(assignment, redact_values=args.redact_values)
                     for assignment in all_assignments
                 ],
                 ensure_ascii=False,
@@ -500,7 +517,7 @@ def command_render(args: argparse.Namespace) -> int:
 
     if args.format == "gh":
         for assignment in all_assignments:
-            print(assignment.shell_command())
+            print(assignment.shell_command(redact_body=args.redact_values, redact_metadata=args.redact_values))
         return 0
 
     current_target = None
@@ -511,7 +528,8 @@ def command_render(args: argparse.Namespace) -> int:
             if assignment.environment:
                 suffix += f":{assignment.environment}"
             print(f"# {assignment.target_id} -> {assignment.repository} ({suffix})")
-        print(f"{assignment.name}={shlex.quote(assignment.value)}")
+        value = redacted_value() if args.redact_values else assignment.value
+        print(f"{assignment.name}={shlex.quote(value)}")
     return 0
 
 
@@ -521,10 +539,15 @@ def command_apply(args: argparse.Namespace) -> int:
         all_assignments.extend(build_assignments(target))
 
     for assignment in all_assignments:
-        print(assignment.shell_command())
+        redact_preview = not args.show_values
+        print(assignment.shell_command(redact_body=redact_preview, redact_metadata=redact_preview))
 
     if not args.yes:
-        print("\nDry run only. Re-run with --yes to apply these GitHub variables.")
+        if args.show_values:
+            print("\nDry run only. Re-run with --yes to apply these GitHub variables.")
+        else:
+            print("\nDry run only. Re-run with --yes to apply these GitHub variables.")
+            print("Values are redacted by default; add --show-values only in a private local terminal.")
         return 0
 
     for assignment in all_assignments:
@@ -548,11 +571,17 @@ def build_parser() -> argparse.ArgumentParser:
     render = subparsers.add_parser("render", help="render generated variables")
     render.add_argument("targets", nargs="*", help="target JSON files; defaults to all targets")
     render.add_argument("--format", choices=("env", "gh", "json"), default="env")
+    render.add_argument("--redact-values", action="store_true", help="hide assignment values in rendered output")
     render.set_defaults(func=command_render)
 
     apply = subparsers.add_parser("apply", help="preview or apply GitHub variable updates")
     apply.add_argument("targets", nargs="*", help="target JSON files; defaults to all targets")
     apply.add_argument("--yes", action="store_true", help="apply updates with gh variable set")
+    apply.add_argument(
+        "--show-values",
+        action="store_true",
+        help="print exact values in the preview; avoid this in public CI logs",
+    )
     apply.set_defaults(func=command_apply)
 
     repository = subparsers.add_parser("repository", help="print the configured platform repository")

tests/test_runtime_settings.py

@@ -69,6 +69,38 @@ def test_plugin_mount_schema_version_is_rendered_for_platform_parser(self):
             assignments["SCHWAB_STRATEGY_PLUGIN_MOUNTS_JSON"],
         )
 
+    def test_assignment_payload_can_redact_values(self):
+        _, target = self.load_target("examples/targets/longbridge/sg.example.json")
+        assignment = next(
+            item
+            for item in runtime_settings.build_assignments(target)
+            if item.name == "RUNTIME_TARGET_JSON"
+        )
+
+        payload = runtime_settings.assignment_payload(assignment, redact_values=True)
+
+        self.assertEqual(payload["value"], "<redacted>")
+        self.assertTrue(payload["value_redacted"])
+        self.assertNotIn(target["runtime_target"]["strategy_profile"], json.dumps(payload))
+        self.assertNotIn(target["runtime_target"]["service_name"], json.dumps(payload))
+
+    def test_assignment_shell_command_can_redact_body_and_metadata(self):
+        _, target = self.load_target("examples/targets/longbridge/sg.example.json")
+        assignment = next(
+            item
+            for item in runtime_settings.build_assignments(target)
+            if item.name == "RUNTIME_TARGET_JSON"
+        )
+
+        command = assignment.shell_command(redact_body=True, redact_metadata=True)
+
+        self.assertIn("--repo '<redacted>'", command)
+        self.assertIn("--body '<redacted>'", command)
+        self.assertIn("--env '<redacted>'", command)
+        self.assertNotIn(assignment.value, command)
+        self.assertNotIn(assignment.repository, command)
+        self.assertNotIn(assignment.environment, command)
+
     def test_plugin_mount_schema_version_must_be_non_empty_string(self):
         _, target = self.load_target("examples/targets/schwab/live.example.json")
         target["plugin_mounts"][0]["expected_schema_version"] = ""