Describe the bug, including details regarding any error messages, version, and platform.
In dev/archery/archery/utils/command.py, Command.run() logs the full subprocess invocation at the DEBUG level:
logger.debug(f"Executing {invocation}")
If Archery is run with --debug, any sensitive values passed as CLI arguments (like --token, --password, or Docker -e AWS_SECRET_ACCESS_KEY=...) are printed in plain text to the logs.
Proposed Fix:
Add a lightweight redaction filter to the logger.debug() statement to mask common secret patterns before logging, while leaving the actual subprocess.run() execution unchanged.
Component(s)
Archery
Describe the bug, including details regarding any error messages, version, and platform.
In
dev/archery/archery/utils/command.py,Command.run()logs the full subprocess invocation at theDEBUGlevel:logger.debug(f"Executing{invocation}")If Archery is run with
--debug, any sensitive values passed as CLI arguments (like--token,--password, or Docker-e AWS_SECRET_ACCESS_KEY=...) are printed in plain text to the logs.Proposed Fix:
Add a lightweight redaction filter to the
logger.debug()statement to mask common secret patterns before logging, while leaving the actualsubprocess.run()execution unchanged.Component(s)
Archery