Lee-W commented on code in PR #70830:
URL: https://github.com/apache/airflow/pull/70830#discussion_r3736656451
##########
providers/common/ai/docs/retry_policies.rst:
##########
@@ -158,22 +159,66 @@ Parameters
* - ``timeout``
- 30.0
- Max seconds to wait for the LLM response before falling back.
- * - ``redact_exception``
- - True
- - When ``True``, the exception's string representation is passed through
- Airflow's secrets masker before being added to the classification
- prompt. This only masks values already registered via
- ``mask_secret()`` (e.g. connection passwords Airflow captured while
- resolving the failing task's connections) -- it is not general-purpose
- PII detection and will not catch arbitrary sensitive strings that were
- never registered as secrets. Set to ``False`` only if you are certain
- your exception messages contain no sensitive data and you need the
- raw text for accurate classification.
+ * - ``redactor``
+ - Airflow's secrets masker
+ - Callable ``(str) -> str`` applied to the exception's string
+ representation before it is added to the classification prompt. The
+ default only masks values already registered via ``mask_secret()``
+ (e.g. connection passwords Airflow captured while resolving the
+ failing task's connections) -- it is not general-purpose PII
+ detection and will not catch arbitrary sensitive strings that were
+ never registered as secrets. Passing a custom callable **replaces**
+ the default masker entirely rather than stacking on top of it; pass
+ ``None`` to disable redaction altogether.
+ * - ``max_exception_length``
+ - 4096
+ - Maximum number of characters of the (already redacted) exception
+ message included in the prompt. Longer messages are truncated with a
+ trailing ``"... (truncated)"`` marker. Must be a positive integer.
+
+Custom redactors
+----------------
+
+The default ``redactor`` only masks values already registered with Airflow's
+secrets masker via ``mask_secret()``. It does not detect free-text PII --
+email addresses, customer names, account numbers -- that were never
+registered as secrets. If your task's exception messages can contain that
+kind of data, supply your own ``redactor`` callable. It **replaces** the
+default masker rather than running in addition to it, so combine your own
+logic with :func:`~airflow.sdk.log.redact` yourself if you still want
+known-secret masking too:
+
+.. code-block:: python
+
+ import re
+
+ from airflow.sdk.log import redact
Review Comment:
Agreed — pinning docs to that path would age badly. The default is now an
exported module-level function in the policy module, and both the docstring and
the docs reference that instead of `airflow.sdk.log.redact`.
I named it `redact_registered_secrets` rather than `default_redactor` so
this function is still a verb instead of a noun
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
