fix(config): omit values from config set error messages

Description

glab config set reported failures as:

failed to set "<key>" to "<value>": <cause>

For credential keys — token, job_token, oauth2_refresh_token — that wrote the secret to stderr, where it lands in CI logs, terminal scrollback, and AI agent transcripts. Reproduced with a keyring backend that rejects the write:

ERROR  Failed to set "token" to "glpat-REDACTED": exit status 161.

This reports only the key. The user supplied the value, so the key is enough to locate the failure, and the underlying cause is still wrapped.

Found while investigating #8262 (closed) (sandboxed glab usage). Not a fix for that issue and does not resolve it — the leak is independent of sandboxing and worth fixing on its own.

How has this been tested?

New test TestConfigSet_ErrorOmitsValue drives the command through cmdtest.SetupCmdForTest with a config stub whose Set fails, then asserts the credential is absent from the error while the key and the underlying cause are both present.

Verified the test is not vacuous: reintroducing the old format string fails it with

"failed to set \"token\" to \"glpat-nOtARealToken\": keyring is locked" should not contain "glpat-nOtARealToken"

go test ./internal/commands/config/... and golangci-lint are clean; full pre-push suite passed.

Edited by Kai Armstrong

Merge request reports

Loading
Loading