Documentation
¶
Overview ¶
Package log is the cross-cutting redaction logger. Plugins and core code MUST route all informational/diagnostic output through this logger; direct writes to os.Stdout / os.Stderr from plugin code are forbidden. The logger strips emails, ARNs, UUIDs, access key IDs, JWTs, and configured secret shapes at the write boundary, so CI log capture cannot exfiltrate identifiers even in --verbose mode.
See docs/architecture/02-layers.md §Logging and redaction.
Package log provides a minimal redaction-aware logger for the CLI. Plugins and core code MUST route diagnostic output through this logger so known PII shapes (emails, ARNs, UUIDs in identifier position, AWS access key IDs, JWTs) are stripped before they reach CI log storage. See docs/architecture/02-layers.md §Logging and redaction.
The redaction patterns are deliberately conservative — they match canonical formats, not heuristic shapes. False negatives are preferable to false positives at this layer; the structural privacy boundary at L6 is the load-bearing guarantee.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Logger ¶
type Logger struct {
// contains filtered or unexported fields
}
Logger emits redacted records to its sink. Construct via New. The zero value is not usable; New always returns a fully-initialized logger.
func Default ¶
func Default() *Logger
Default returns a logger writing to os.Stderr in non-verbose mode. Used by callers that don't need fine control.
func New ¶
New returns a logger writing to sink. If verbose is true, Debug records are emitted; otherwise Debug is suppressed. Redaction is always on — no flag disables it.
Source Files