fix(config): omit values from config set error messages
Description
glab config set reported failures as:
failed to set "<key>" to "<value>": <cause>For credential keys — token, job_token, oauth2_refresh_token — that
wrote the secret to stderr, where it lands in CI logs, terminal
scrollback, and AI agent transcripts. Reproduced with a keyring backend
that rejects the write:
ERROR Failed to set "token" to "glpat-REDACTED": exit status 161.This reports only the key. The user supplied the value, so the key is enough to locate the failure, and the underlying cause is still wrapped.
Related Issues
Found while investigating #8262 (closed) (sandboxed glab usage). Not a fix for
that issue and does not resolve it — the leak is independent of
sandboxing and worth fixing on its own.
How has this been tested?
New test TestConfigSet_ErrorOmitsValue drives the command through
cmdtest.SetupCmdForTest with a config stub whose Set fails, then
asserts the credential is absent from the error while the key and the
underlying cause are both present.
Verified the test is not vacuous: reintroducing the old format string fails it with
"failed to set \"token\" to \"glpat-nOtARealToken\": keyring is locked" should not contain "glpat-nOtARealToken"go test ./internal/commands/config/... and golangci-lint are clean;
full pre-push suite passed.