fix: omniroute API key grep visible in ansible output

[dmzoneill]

lookup('pipe', 'grep ^KEY= .env') exposes keys. Use no_log or vault.

[github-actions]

Based on the issue description, here's the recommended fix for the Ansible security vulnerability:

Solution

The issue is that using lookup('pipe', 'grep ^KEY= .env') in Ansible will expose sensitive API keys in the output logs. Here are two solutions:

Option 1: Use no_log: true (Quick Fix)

Add no_log: true to any task that retrieves the API key:

- name: Get omniroute API key
  set_fact:
    omniroute_api_key: "{{ lookup('pipe', 'grep ^KEY= .env') | regex_replace('^KEY=', '') }}"
  no_log: true

Option 2: Use Ansible Vault (Recommended)

Instead of reading from .env files, store secrets in Ansible Vault:

# Create a vault file
ansible-vault create vars/secrets.yml

Add the key to the vault:

---
omniroute_api_key: "your-secret-key-here"

Then reference it in your playbook:

- name: Load secrets
  include_vars:
    file: vars/secrets.yml
  no_log: true

Best Practice Recommendation

Use Ansible Vault for production environments as it provides:

• Encryption at rest
• Version control safety (encrypted values)
• Better secret management

For development, at minimum add no_log: true to prevent accidental exposure in logs and CI/CD output.

[dmzoneill]

Re-audit confirmed: omniroute API key via grep from .env visible in ansible output. no_log on task body but lookup still unprotected.