kevinveenbirkenbachandClaude Opus 5 ea85683796 fix(security): hoist uniform credential no_log to the include and mask bridge loops ...

b3ce43a596 set no_log on every task of two included files, which
test_include_uniform_apply_keyword rejects: a keyword every included task
repeats belongs in the include's apply block. The Cloudflare development
mode tasks and the ChatGPT bridge token tasks now receive no_log through
apply at their include sites. The matrix include had set no_log on the
include task itself, which never reaches the included tasks.

Two loops over MATRIX_BRIDGES were unmasked: the bridge folder creation
and the readiness gate. A loop result prints the whole item, and every item
carries the bridge's database_password, so both printed it at -v whenever
MASK_CREDENTIALS_IN_LOGS is on. The credential lint cannot see this because
the loop variable's name carries no secret marker.

Verified: test_include_uniform_apply_keyword, the credential masking lint,
the task lints and the matrix unit tests pass, and ansible-lint is clean on
the five files.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-11 22:50:54 +02:00

..

01_enable_cf_dev_mode.yml

fix(security): hoist uniform credential no_log to the include and mask bridge loops

2026-09-11 22:50:54 +02:00

02_cleanup.yml

fix(security): require no_log on every task that carries a credential

2026-09-11 21:52:18 +02:00