-
-
Notifications
You must be signed in to change notification settings - Fork 45
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: support masking secrets (#1115)
* feat: support masking secrets * fix: fix lint errors * fix: fix error handling * fix(mask): change the default separator from `;` to `,` `;` has a special meaning in shell script. For example, the following command doesn't work as expected. ```sh export TFCMT_MASKS=env:GITHUB_TOKEN;env:DATADOG_API_KEY ``` To prevent the bug, I change the separator.
- Loading branch information
1 parent
b47d3c3
commit 74ffe99
Showing
16 changed files
with
178 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| package mask | ||
|
|
||
| import ( | ||
| "errors" | ||
| "fmt" | ||
| "os" | ||
| "regexp" | ||
| "strings" | ||
|
|
||
| "github.com/sirupsen/logrus" | ||
| "github.com/suzuki-shunsuke/logrus-error/logerr" | ||
| "github.com/suzuki-shunsuke/tfcmt/v4/pkg/config" | ||
| ) | ||
|
|
||
| func ParseMasksFromEnv() ([]*config.Mask, error) { | ||
| return ParseMasks(os.Getenv("TFCMT_MASKS"), os.Getenv("TFCMT_MASKS_SEPARATOR")) | ||
| } | ||
|
|
||
| func ParseMasks(maskStr, maskSep string) ([]*config.Mask, error) { | ||
| if maskStr == "" { | ||
| return nil, nil | ||
| } | ||
| if maskSep == "" { | ||
| maskSep = "," // default separator | ||
| } | ||
| maskStrs := strings.Split(maskStr, maskSep) | ||
| masks := make([]*config.Mask, 0, len(maskStrs)) | ||
| for _, maskStr := range maskStrs { | ||
| mask, err := parseMask(maskStr) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("parse a mask: %w", logerr.WithFields(err, logrus.Fields{ | ||
| "mask": maskStr, | ||
| })) | ||
| } | ||
| if mask == nil { | ||
| continue | ||
| } | ||
| masks = append(masks, mask) | ||
| } | ||
| return masks, nil | ||
| } | ||
|
|
||
| func parseMask(maskStr string) (*config.Mask, error) { | ||
| typ, value, ok := strings.Cut(maskStr, ":") | ||
| if !ok { | ||
| return nil, errors.New("the mask is invalid. ':' is missing") | ||
| } | ||
| switch typ { | ||
| case "env": | ||
| if e := os.Getenv(value); e != "" { | ||
| return &config.Mask{ | ||
| Type: "equal", | ||
| Value: e, | ||
| }, nil | ||
| } | ||
| // the environment variable is missing | ||
| return nil, nil //nolint:nilnil | ||
| case "regexp": | ||
| p, err := regexp.Compile(value) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("the regular expression is invalid: %w", err) | ||
| } | ||
| return &config.Mask{ | ||
| Type: "regexp", | ||
| Value: value, | ||
| Regexp: p, | ||
| }, nil | ||
| default: | ||
| return nil, errors.New("the mask type is invalid") | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| package mask | ||
|
|
||
| import ( | ||
| "io" | ||
| "strings" | ||
|
|
||
| "github.com/suzuki-shunsuke/tfcmt/v4/pkg/config" | ||
| ) | ||
|
|
||
| const ( | ||
| typeEqual = "equal" | ||
| typeRegexp = "regexp" | ||
| ) | ||
|
|
||
| type Writer struct { | ||
| patterns []*config.Mask | ||
| w io.Writer | ||
| } | ||
|
|
||
| func NewWriter(w io.Writer, patterns []*config.Mask) *Writer { | ||
| return &Writer{ | ||
| w: w, | ||
| patterns: patterns, | ||
| } | ||
| } | ||
|
|
||
| func (w *Writer) Write(p []byte) (int, error) { | ||
| a := p | ||
| for _, pattern := range w.patterns { | ||
| switch pattern.Type { | ||
| case typeEqual: | ||
| a = []byte(strings.ReplaceAll(string(a), pattern.Value, "***")) | ||
| case typeRegexp: | ||
| a = pattern.Regexp.ReplaceAll(a, []byte("***")) | ||
| } | ||
| } | ||
| _, err := w.w.Write(a) | ||
| return len(p), err | ||
| } | ||
|
|
||
| func Mask(s string, patterns []*config.Mask) string { | ||
| a := s | ||
| for _, pattern := range patterns { | ||
| switch pattern.Type { | ||
| case typeEqual: | ||
| a = strings.ReplaceAll(a, pattern.Value, "***") | ||
| case typeRegexp: | ||
| a = pattern.Regexp.ReplaceAllString(a, "***") | ||
| } | ||
| } | ||
| return a | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters