Redact GitLab access token from error log message

[beyang]

t=2020-01-27T20:53:04+0000 lvl=warn msg="error cloning repo" repo=REDACTED err="error cloning repo: repo REDACTED (https://git:TOKEN@REDACTED.git) not cloneable: exit status 128 (output follows)\n\nremote: You are not allowed to download code from this project.\nfatal: unable to access 'https://REDACTED.git/': The requested URL returned error: 403\n"

When the GitLab token is unauthorized to download repository contents, an error message is printed to the logs that contains the clone URL, which can contain the access token. The access token should be redacted from logs.

[keegancsmith]

This is likely something where we should take a step back and design something better. We can probably avoid these remote URLs living in plaintext in the gitconfig per repo. I propose this as part of the agenda for our impromptu core services meetup in London next week! But having a better design shouldn't block us doing a quick fix. The quick fix in this case is likely scrubbing stderr of the remote url / password for the repo. This should be quite efficient since we don't send back all of stderr, but instead we actually only read the first 256 bytes into a []byte for stderr. So pretty trivial to do (only concerns is things like the token partially appearing where we truncate stderr output).

[uwedeportivo]

Dear all,

This is your release captain speaking. 🚂🚂🚂

Branch cut for the 3.13 release is scheduled for tomorrow.

Is this issue / PR going to make it in time? Please change the milestone accordingly.
When in doubt, reach out!

Thank you