The GitHub Actions job "Tests (AMD)" on airflow.git/v3-2-test has succeeded.
Run started by GitHub user vatsrahul1001 (triggered by vatsrahul1001).
Head commit for run:
84380fe0e1cf2b216eb1f883c7a3df84715b9105 / github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
[v3-2-test] Mask per-key secrets-backend-kwarg overrides on the Config API
(#67622) (#67629)
Per-key environment-variable overrides like
`AIRFLOW__SECRETS__BACKEND_KWARG__SECRET_ID` and
`AIRFLOW__WORKERS__SECRETS_BACKEND_KWARG__SECRET_ID` are materialised by
`conf.as_dict` as synthetic options under the `secrets` and `workers` sections
(e.g. `backend_kwarg__secret_id`). These synthetic options carry the same Vault
/ role_id / secret_id material as the registered `backend_kwargs` option, but
they are not present in `conf.sensitive_config_values`, so the Config API was
returning their values unmasked.
This change adds:
- a constant `_PER_KEY_SENSITIVE_PREFIXES` that names the two synthetic-option
prefixes,
- a helper `_mask_per_key_sensitive_options` that the `GET /config` route calls
when `display_sensitive=False`,
- a helper `_is_per_key_sensitive_option` that extends the sensitivity check in
the `GET /config/section/{section}/option/{option}` route.
Reference: airflow-s/airflow-s#433
(cherry picked from commit f0f978d2736891a2f9e9d2954e87fc358e1ef4e3)
Generated-by: Claude Opus 4.7 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
Co-authored-by: Jarek Potiuk <[email protected]>
Report URL: https://github.com/apache/airflow/actions/runs/26644088034
With regards,
GitHub Actions via GitBox
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
