Skip to content

Semantic Release is hiding too much the job log when using Vault template

Describe the bug

When we're using the Vault variant, Semantic Release is hiding a lot of strings in the job log.

Expected behavior

The job log should be a lot more readable, with less false positive.

Actual behavior

Job log lines are filled with [secure] everywhere.

Logs and/or screenshots

Some logs for example:

[[secure] AM] [semantic-[secure]] > Run automated [secure] from branch [secure] on [secure] [secure]://[secure]:[secure]@[secure]/[secure].git in dry-run mode

Context & Configuration

The issue was reproduced using:

  • Version of the template: 3.11
  • GitLab server(s): self-managed server

What's happening (as far as I understand)

When the vault variant is used, every variables are duplicated with VAULT_SECRET_PROVIDER_ prefix.

In lib/hide-sensitive.js file, those variables will be selected for hiding since they contain secret in their name.

The regex is the build with then content of all those variables.

Edited by Benjamin Plusquellec