ci(workflows): secret-redaction filter for 9 secret env vars (REQ-INB-56)

---ci---
project: inboxos
phase: 1
milestone: v1.4
status: execute
wave: 1
task: T7
---/ci---

.env.example

@@ -137,8 +137,14 @@ OPENCODE_PROMPT_DIR=./.opencode/commands
                                      # $SEAWEEDFS_S3_BUCKET if unset.
 
 # OPENCODE_NPM_VERSION=latest        # historical pipeline's opencode CLI
-                                     # version (the opencode backend is
-                                     # offline-tests-only in production
-                                     # but the env var is still referenced
-                                     # by pipelines/common.py).
+                                      # version (the opencode backend is
+                                      # offline-tests-only in production
+                                      # but the env var is still referenced
+                                      # by pipelines/common.py).
 # ── end Workflow tunables ──────────────────────────────
+
+# ── v1.4 notes ──────────────────────────────────────────
+# The workflow YAML auto-masks the above secret values in CI
+# logs via `::add-mask::` (REQ-INB-56). Do not echo them in
+# custom `run:` steps; the mask only protects values Gitea
+# Actions sees, not values that are echoed in plain text.

.gitea/workflows/ci-pr.yml

@@ -69,6 +69,15 @@ jobs:
       # Quiet per-message logging in the offline tests.
       LOG_LEVEL: "WARNING"
     steps:
+      # v1.4 REQ-INB-56: secret-redaction mask for the 9 secret env vars
+      - name: Secret mask (REQ-INB-56)
+        run: |
+          for v in IMAP_PASSWORD NOCODB_API_TOKEN NOCODB_API_TOKEN_READONLY GITEA_USER GITEA_PASS SEAWEEDFS_S3_ACCESS_KEY SEAWEEDFS_S3_SECRET_KEY PAPRA_API_TOKEN OLLAMA_API_KEY; do
+            val="${!v:-}"
+            if [ -n "$val" ]; then
+              echo "::add-mask::$val"
+            fi
+          done
       - name: Checkout repo
         uses: actions/checkout@v4
 

.gitea/workflows/historical-pipeline.yml

@@ -84,6 +84,15 @@ jobs:
     env:
       PYTHONUNBUFFERED: "1"
     steps:
+      # v1.4 REQ-INB-56: secret-redaction mask for the 9 secret env vars
+      - name: Secret mask (REQ-INB-56)
+        run: |
+          for v in IMAP_PASSWORD NOCODB_API_TOKEN NOCODB_API_TOKEN_READONLY GITEA_USER GITEA_PASS SEAWEEDFS_S3_ACCESS_KEY SEAWEEDFS_S3_SECRET_KEY PAPRA_API_TOKEN OLLAMA_API_KEY; do
+            val="${!v:-}"
+            if [ -n "$val" ]; then
+              echo "::add-mask::$val"
+            fi
+          done
       - name: Checkout repo
         uses: actions/checkout@v4
 

.gitea/workflows/live-pipeline.yml

@@ -86,6 +86,15 @@ jobs:
     env:
       PYTHONUNBUFFERED: "1"
     steps:
+      # v1.4 REQ-INB-56: secret-redaction mask for the 9 secret env vars
+      - name: Secret mask (REQ-INB-56)
+        run: |
+          for v in IMAP_PASSWORD NOCODB_API_TOKEN NOCODB_API_TOKEN_READONLY GITEA_USER GITEA_PASS SEAWEEDFS_S3_ACCESS_KEY SEAWEEDFS_S3_SECRET_KEY PAPRA_API_TOKEN OLLAMA_API_KEY; do
+            val="${!v:-}"
+            if [ -n "$val" ]; then
+              echo "::add-mask::$val"
+            fi
+          done
       - name: Checkout repo
         uses: actions/checkout@v4