From e5f98435ed6d1a6dba33b9023563f8c08ad21cbe Mon Sep 17 00:00:00 2001
From: jklein <github@justin-klein.de>
Date: Wed, 26 Aug 2026 14:37:46 +0200
Subject: [PATCH] ci: redact declared secret values from install-test
 diagnostics

The failure path prints container logs, and an app may print a value it was
given - gluetun logs its Wireguard address on startup. diagnose() now runs
through a filter that replaces the values of the declared REQUIRED_ENV
variables with the variable name. GitHub masks them as well, but that is the
platform's promise rather than this harness's, and the script runs locally too,
where nothing masks anything.
---
 ci/run-install-test.sh | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/ci/run-install-test.sh b/ci/run-install-test.sh
index 0f988a7..efd9f3b 100755
--- a/ci/run-install-test.sh
+++ b/ci/run-install-test.sh
@@ -78,6 +78,25 @@ for VAR in $REQUIRED_ENV; do
 done
 
 # --- Failure diagnostics ----------------------------------------------------
+# The diagnostics echo application output, and an app may well print a value it
+# was given: gluetun logs its Wireguard address on startup. So everything the
+# failure path prints runs through a filter that replaces the values of the
+# declared REQUIRED_ENV variables with the variable name. GitHub masks them as
+# well, but that is the platform's promise rather than this harness's - and the
+# script runs locally too, where nothing masks anything.
+redact_secrets() {
+  if [ -z "$REQUIRED_ENV" ]; then
+    cat
+    return
+  fi
+  local SED_ARGS=()
+  local VAR
+  for VAR in $REQUIRED_ENV; do
+    SED_ARGS+=(-e "s|${!VAR}|<redacted:$VAR>|g")
+  done
+  sed "${SED_ARGS[@]}"
+}
+
 diagnose() {
   echo "=================== INSTALL-TEST FAILED: DIAGNOSTICS ==================="
   echo "--- pods ---"
@@ -94,7 +113,7 @@ diagnose() {
   done
   echo "========================================================================"
 }
-trap 'RC=$?; if [ $RC -ne 0 ]; then diagnose; fi; exit $RC' EXIT
+trap 'RC=$?; if [ $RC -ne 0 ]; then diagnose | redact_secrets; fi; exit $RC' EXIT
 
 # --- 1. Apply fixtures ------------------------------------------------------
 echo "::group::Apply fixtures"
@@ -102,8 +121,8 @@ kubectl apply -f "$CI_DIR/common/"
 if [ -f "$CI_DIR/$CHART/fixtures.yaml" ]; then
   kubectl apply -f "$CI_DIR/$CHART/fixtures.yaml"
 fi
-# Fixtures with values that must not be committed are rendered first: the
-# checked-in fixtures.env.yaml holds ${VARIABLE} placeholders and nothing else.
+# Fixtures with values that must not be committed are rendered before they are
+# applied: the checked-in fixtures.env.yaml holds ${VARIABLE} placeholders only.
 # envsubst is restricted to the names from REQUIRED_ENV (its SHELL-FORMAT
 # argument), so a variable that is not declared there is never substituted, no
 # unrelated "$..." in the manifest is touched, and no other variable of the