Documentation
¶
Overview ¶
Package redact masks credential-bearing values so they don't reach logs, error messages, or anywhere else go-make prints. It centralizes the rules so the name denylist and the secret-shape patterns live in exactly one place rather than drifting across the run, fetch, and github packages.
Index ¶
Constants ¶
const Mask = "***"
Mask is the placeholder substituted for a redacted value.
Variables ¶
This section is empty.
Functions ¶
func Args ¶
Args returns a copy of args with credential-looking values masked, suitable for logging a command line. It handles two shapes:
- "name=value" / "--flag=value": the value is masked when the key looks sensitive AND the value is non-empty (an empty value is not a secret, so e.g. "credential.helper=" is left readable).
- "--flag" followed by a separate value token: the following token is masked when the flag looks sensitive (e.g. "--token", "secret").
A bare positional secret cannot be detected by name and passes through unchanged — callers must avoid putting raw secrets in positional arguments.
func IsSensitiveName ¶
IsSensitiveName reports whether name looks like it holds a credential.
func Secrets ¶
Secrets scrubs known credential shapes out of an arbitrary string. Use it for content that may contain secrets but isn't keyed by name — command output captured on failure, fetched URLs, and the like. It is best-effort by design: it masks the shapes go-make actually handles (GitHub tokens, Authorization headers, URL userinfo) and cannot catch an arbitrary opaque secret.
Types ¶
This section is empty.
Source Files