github-actions[bot] opened a new pull request, #71099: URL: https://github.com/apache/airflow/pull/71099
* Hide team scoped values of options registered as sensitive Options are registered as sensitive under their base section, but a team scoped override lives in a `[<team>=<section>]` config file section, or in an `AIRFLOW__<TEAM>___<SECTION>__<KEY>` environment variable. Every sensitivity decision was a direct membership test against the registered base pairs, and the masking pass iterated those pairs and looked each section up verbatim, so a team scoped section was never visited and its value was returned in clear. Resolve the team scoped spelling back to the base option before deciding whether a value is sensitive. `team_section_name` now builds the config file section name at both construction sites so the two representations cannot drift, `base_section_name` recovers the base section from it, and `is_sensitive_option` tests a pair directly, then via the base section, then via the tail an environment variable contributes -- so it can only ever recognise more options as sensitive, never fewer. The team name is not parsed out of an environment variable name, because a team name may contain underscores; the name is matched against the tail each registered option contributes instead. The config file section name is split on the last separator, so the base section is recovered even for a team name that contains the separator itself. Four call sites use the predicate: the masking pass, the environment collection, `write`, and the single option config route, which does not go through `as_dict` and so needed its own change. Team scoped `_cmd` and `_secret` entries are hidden in place rather than resolved into their value, because resolving them is not supported for a team. Generated-by: Claude Opus 5 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Add newsfragment for the team scoped sensitive option masking change * Keep one copy of the team scoped masking rationale, and record the untouched gap The per-key secrets-backend options are matched by literal section name and stay unaware of a team scoped spelling. Nothing leaks while the secrets backend itself is not team aware, so it is recorded rather than fixed here. * Update shared/configuration/tests/configuration/test_parser.py Co-authored-by: Amogh Desai <[email protected]> * Update airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_config.py Co-authored-by: Amogh Desai <[email protected]> --------- (cherry picked from commit d41ac7b6d213682db3ef4d21bbb33e013dde4af4) Co-authored-by: Jarek Potiuk <[email protected]> Co-authored-by: Amogh Desai <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
