The GitHub Actions job "Tests (AMD)" on airflow.git/content-pattern-masking has failed. Run started by GitHub user dkranchii (triggered by dkranchii).
Head commit for run: cb6dca639d4706fdc85dfb9fee39a2fa0e8d7107 / Deepak Kumar <[email protected]> Redact well-known secret formats in logs and rendered fields Airflow's SecretsMasker decides what to hide by key name, not by the shape of the value. As the current docs acknowledge, keys in a Connection extra whose names do not match a sensitive keyword are not redacted, and values that flow through XCom or any other side channel reach Task logs and Rendered fields as-is even on a correctly configured deployment. Users routinely leak live credentials this way by printing environment variables during debugging, logging stack traces that include a token or PEM block, or pushing values through XCom keys whose names do not happen to match the sensitive-keyword list. Registering secrets ahead of time via mask_secret(), Connections, and Variables only covers values Airflow was told about. This adds a second line of defense so that even when Airflow was never told a specific value was sensitive, values that match a small curated set of well-known credential formats are redacted before they reach logs or rendered fields. The feature is opt-in (default False) so no existing deployment changes behavior. The initial pattern set is deliberately narrow - each entry has a distinctive fixed prefix so a match is overwhelmingly likely to be a real credential, and formats with high false-positive rates in log data are left out of the built-ins. Deployments that want additional formats can register them via add_content_patterns() rather than editing Airflow. All patterns use bounded or fixed-width bodies so the regex engine's work stays strictly linear on any input. related: #58514 Report URL: https://github.com/apache/airflow/actions/runs/30775291208 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
