fix: mask secrets in CI publications

Author: shirkevich

pkg/ci/internal/provider/masking.go

@@ -0,0 +1,14 @@
+package provider
+
+import (
+	atmosio "github.com/cloudposse/atmos/pkg/io"
+	"github.com/cloudposse/atmos/pkg/perf"
+)
+
+// MaskPublishedContent applies the global secret masker before CI content
+// leaves the process through a human-facing provider surface.
+func MaskPublishedContent(content string) string {
+	defer perf.Track(nil, "provider.MaskPublishedContent")()
+
+	return atmosio.MaskString(content)
+}

pkg/ci/internal/provider/output.go

@@ -96,7 +96,7 @@ func (w *FileOutputWriter) WriteSummary(content string) error {
 	}
 	defer f.Close()
 
-	_, err = f.WriteString(content)
+	_, err = f.WriteString(MaskPublishedContent(content))
 	if err != nil {
 		return fmt.Errorf("%w: failed to write summary: %w", errUtils.ErrCISummaryWriteFailed, err)
 	}

pkg/ci/internal/provider/output_test.go

@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	atmosio "github.com/cloudposse/atmos/pkg/io"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -119,6 +120,23 @@ func TestFileOutputWriter_WriteSummary(t *testing.T) {
 	assert.Equal(t, "# Summary\n\nThis is a test.", string(content))
 }
 
+func TestFileOutputWriter_WriteSummary_MasksRegisteredSecrets(t *testing.T) {
+	atmosio.Reset()
+	t.Cleanup(atmosio.Reset)
+
+	const secret = "ci-summary-secret-ABCD1234"
+	atmosio.RegisterSecret(secret)
+
+	summaryPath := filepath.Join(t.TempDir(), "summary.md")
+	writer := &FileOutputWriter{SummaryPath: summaryPath}
+	require.NoError(t, writer.WriteSummary("value: postgresql://user:"+secret+"@database.example:5432/app"))
+
+	content, err := os.ReadFile(summaryPath)
+	require.NoError(t, err)
+	assert.NotContains(t, string(content), secret)
+	assert.Contains(t, string(content), atmosio.MaskReplacement)
+}
+
 func TestFileOutputWriter_WriteSummary_Append(t *testing.T) {
 	tmpDir := t.TempDir()
 	summaryPath := filepath.Join(tmpDir, "summary.md")

pkg/ci/providers/generic/check.go

@@ -12,13 +12,15 @@ import (
 // CreateCheckRun writes check run status to stderr and returns a synthetic CheckRun.
 func (p *Provider) CreateCheckRun(_ context.Context, opts *provider.CreateCheckRunOptions) (*provider.CheckRun, error) {
 	defer perf.Track(nil, "generic.Provider.CreateCheckRun")()
+	title := provider.MaskPublishedContent(opts.Title)
+	summary := provider.MaskPublishedContent(opts.Summary)
 
 	ui.Infof("Check run created: %s [%s]", opts.Name, opts.Status)
-	if opts.Title != "" {
-		ui.Infof("  Title: %s", opts.Title)
+	if title != "" {
+		ui.Infof("  Title: %s", title)
 	}
-	if opts.Summary != "" {
-		ui.Infof("  Summary: %s", opts.Summary)
+	if summary != "" {
+		ui.Infof("  Summary: %s", summary)
 	}
 
 	id := p.nextCheckRunID.Add(1)
@@ -27,15 +29,17 @@ func (p *Provider) CreateCheckRun(_ context.Context, opts *provider.CreateCheckR
 		ID:        id,
 		Name:      opts.Name,
 		Status:    opts.Status,
-		Title:     opts.Title,
-		Summary:   opts.Summary,
+		Title:     title,
+		Summary:   summary,
 		StartedAt: time.Now(),
 	}, nil
 }
 
 // UpdateCheckRun writes check run status to stderr and returns an updated CheckRun.
 func (p *Provider) UpdateCheckRun(_ context.Context, opts *provider.UpdateCheckRunOptions) (*provider.CheckRun, error) {
 	defer perf.Track(nil, "generic.Provider.UpdateCheckRun")()
+	title := provider.MaskPublishedContent(opts.Title)
+	summary := provider.MaskPublishedContent(opts.Summary)
 	var uiMethod func(format string, a ...interface{})
 	var verb string
 	switch opts.Status {
@@ -55,19 +59,19 @@ func (p *Provider) UpdateCheckRun(_ context.Context, opts *provider.UpdateCheckR
 
 	uiMethod("Check run %s: %s [%s]", verb, opts.Name, opts.Status)
 
-	if opts.Title != "" {
-		uiMethod("  Title: %s", opts.Title)
+	if title != "" {
+		uiMethod("  Title: %s", title)
 	}
-	if opts.Summary != "" {
-		uiMethod("  Summary: %s", opts.Summary)
+	if summary != "" {
+		uiMethod("  Summary: %s", summary)
 	}
 
 	return &provider.CheckRun{
 		ID:         p.nextCheckRunID.Add(1),
 		Name:       opts.Name,
 		Status:     opts.Status,
 		Conclusion: opts.Conclusion,
-		Title:      opts.Title,
-		Summary:    opts.Summary,
+		Title:      title,
+		Summary:    summary,
 	}, nil
 }

pkg/ci/providers/generic/check_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/cloudposse/atmos/pkg/ci/internal/provider"
+	atmosio "github.com/cloudposse/atmos/pkg/io"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -48,6 +49,25 @@ func TestCreateCheckRun(t *testing.T) {
 		assert.NotEqual(t, first.ID, second.ID)
 		assert.Equal(t, first.ID+1, second.ID)
 	})
+
+	t.Run("masks registered secrets in published fields", func(t *testing.T) {
+		atmosio.Reset()
+		t.Cleanup(atmosio.Reset)
+
+		const secret = "generic-check-secret-ABCD1234"
+		atmosio.RegisterSecret(secret)
+		checkRun, err := p.CreateCheckRun(ctx, &provider.CreateCheckRunOptions{
+			Name:    "atmos/plan/test/service",
+			Status:  provider.CheckRunStatePending,
+			Title:   "credential: " + secret,
+			Summary: "diff contains " + secret,
+		})
+		require.NoError(t, err)
+		assert.NotContains(t, checkRun.Title, secret)
+		assert.NotContains(t, checkRun.Summary, secret)
+		assert.Contains(t, checkRun.Title, atmosio.MaskReplacement)
+		assert.Contains(t, checkRun.Summary, atmosio.MaskReplacement)
+	})
 }
 
 func TestUpdateCheckRun(t *testing.T) {

pkg/ci/providers/generic/provider.go

@@ -165,6 +165,7 @@ func (w *OutputWriter) WriteOutput(key, value string) error {
 // WriteSummary writes content to the job summary.
 func (w *OutputWriter) WriteSummary(content string) error {
 	defer perf.Track(nil, "generic.OutputWriter.WriteSummary")()
+	content = provider.MaskPublishedContent(content)
 
 	if w.summaryFile != "" {
 		// Write to file.

pkg/ci/providers/generic/provider_test.go

@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	atmosio "github.com/cloudposse/atmos/pkg/io"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -109,6 +110,23 @@ func TestOutputWriter(t *testing.T) {
 		assert.Contains(t, string(content), "Test content")
 	})
 
+	t.Run("WriteSummary masks registered secrets", func(t *testing.T) {
+		atmosio.Reset()
+		t.Cleanup(atmosio.Reset)
+
+		const secret = "generic-summary-secret-ABCD1234"
+		atmosio.RegisterSecret(secret)
+
+		summaryFile := filepath.Join(t.TempDir(), "summary")
+		w := &OutputWriter{summaryFile: summaryFile}
+		require.NoError(t, w.WriteSummary("credential: "+secret))
+
+		content, err := os.ReadFile(summaryFile)
+		require.NoError(t, err)
+		assert.NotContains(t, string(content), secret)
+		assert.Contains(t, string(content), atmosio.MaskReplacement)
+	})
+
 	t.Run("WriteOutput without file logs debug", func(t *testing.T) {
 		w := &OutputWriter{}
 

pkg/ci/providers/github/checks.go

@@ -28,7 +28,7 @@ func (p *Provider) setCommitStatus(ctx context.Context, owner, repo, sha, status
 	repoStatus := &github.RepoStatus{
 		State:       github.String(state),
 		Context:     github.String(statusContext),
-		Description: github.String(truncateDescription(description)),
+		Description: github.String(truncateDescription(provider.MaskPublishedContent(description))),
 	}
 
 	if targetURL != "" {

pkg/ci/providers/github/checks_test.go

@@ -16,6 +16,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/cloudposse/atmos/pkg/ci/internal/provider"
+	atmosio "github.com/cloudposse/atmos/pkg/io"
 )
 
 func TestMapCheckRunStateToStatusState(t *testing.T) {
@@ -183,6 +184,49 @@ func TestProvider_CreateCheckRun(t *testing.T) {
 	})
 }
 
+func TestProvider_CreateCheckRun_MasksRegisteredSecrets(t *testing.T) {
+	atmosio.Reset()
+	t.Cleanup(atmosio.Reset)
+
+	const secret = "status-secret-ABCD1234"
+	atmosio.RegisterSecret(secret)
+
+	var capturedRequest map[string]any
+	mux := http.NewServeMux()
+	mux.HandleFunc("/repos/owner/repo/statuses/abc123", func(w http.ResponseWriter, r *http.Request) {
+		require.NoError(t, json.NewDecoder(r.Body).Decode(&capturedRequest))
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"id":          12345,
+			"context":     capturedRequest["context"],
+			"state":       capturedRequest["state"],
+			"description": capturedRequest["description"],
+		})
+	})
+
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+	serverURL, err := url.Parse(server.URL + "/")
+	require.NoError(t, err)
+	ghClient := github.NewClient(nil)
+	ghClient.BaseURL = serverURL
+	p := NewProviderWithClient(&Client{client: ghClient})
+
+	_, err = p.CreateCheckRun(context.Background(), &provider.CreateCheckRunOptions{
+		Owner:  "owner",
+		Repo:   "repo",
+		SHA:    "abc123",
+		Name:   "atmos/plan/test/service",
+		Status: provider.CheckRunStatePending,
+		Title:  "credential: " + secret,
+	})
+	require.NoError(t, err)
+	description, ok := capturedRequest["description"].(string)
+	require.True(t, ok)
+	assert.NotContains(t, description, secret)
+	assert.Contains(t, description, atmosio.MaskReplacement)
+}
+
 func TestProvider_UpdateCheckRun(t *testing.T) {
 	t.Run("update is idempotent CreateStatus call", func(t *testing.T) {
 		// UpdateCheckRun should call the same CreateStatus endpoint.

pkg/ci/providers/github/comments.go

@@ -39,6 +39,12 @@ func (p *Provider) postComment(ctx context.Context, opts *provider.PostCommentOp
 	if err := validatePostCommentOptions(opts); err != nil {
 		return nil, err
 	}
+	maskedOpts := *opts
+	maskedOpts.Body = provider.MaskPublishedContent(opts.Body)
+	if err := validatePostCommentOptions(&maskedOpts); err != nil {
+		return nil, err
+	}
+	opts = &maskedOpts
 
 	behavior, err := normalizeBehavior(opts.Behavior)
 	if err != nil {