v1.2.1 - Credential redaction for failed notifications

Published to Ansible Galaxy.

Security fix — upgrade if you use Slack or generic webhook notifications.

A failed notification printed the credential it was sent with

Neither webhook task in vitals_report's notify.yml set no_log, and ansible.builtin.uri does not treat url or headers as secret. A Slack incoming-webhook URL is the bearer token for that channel, so any non-2xx response, DNS failure, timeout, or -v run published it — along with any Authorization header configured through linux_vitals_generic_webhook_headers — into CI logs, terminal scrollback, and any callback plugin or ARA database.

This was reproduced against the shipped 1.2.0 code before the fix was written: a post to an unreachable endpoint printed the token verbatim.

If you have run LinuxVitals with a webhook configured and a notification failed, treat that URL as disclosed and rotate it. For Slack that means revoking the incoming webhook and issuing a new one; for a generic webhook, rotate whatever token the URL or Authorization header carries.

What changed

• All three sends run with no_log and record their outcome instead of failing. Each is followed by a task reporting the failure with only the channel and HTTP status, so notifications stay diagnosable without disclosing the secret.
• The module's own msg is deliberately never echoed — for some failure modes uri embeds the URL in it.
• return_content: true dropped from both posts; nothing consumed the response.
• The email send did not leak (community.general.mail masks password via its argspec and does not echo its arguments on that path). It carries the same treatment as defence in depth, covering the SMTP username and message body.

Tests

tests/test_notification_redaction.py drives the real notify.yml at a closed port, once per channel and at -vv, asserting the credential never appears while the failure stays actionable. Verified to fail against the pre-fix code, so it cannot rot into a test that passes either way.

See CHANGELOG.md and #22.