From ae31098d9a1a499563f3bcabfa236f89bfcf5527 Mon Sep 17 00:00:00 2001
From: cloudinit-bot <cloudinit-bot@cloudinit.dev>
Date: Tue, 9 Jun 2026 14:09:29 +0000
Subject: [PATCH] ci(workflows): secret-redaction filter for 9 secret env vars
 (REQ-INB-56)

---ci---
project: inboxos
phase: 1
milestone: v1.4
status: execute
wave: 1
task: T7
---/ci---
---
 .env.example                             | 14 ++++++++++----
 .gitea/workflows/ci-pr.yml               |  9 +++++++++
 .gitea/workflows/historical-pipeline.yml |  9 +++++++++
 .gitea/workflows/live-pipeline.yml       |  9 +++++++++
 4 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/.env.example b/.env.example
index 9b64c77..a12fe1b 100644
--- a/.env.example
+++ b/.env.example
@@ -137,8 +137,14 @@ OPENCODE_PROMPT_DIR=./.opencode/commands
                                      # $SEAWEEDFS_S3_BUCKET if unset.
 
 # OPENCODE_NPM_VERSION=latest        # historical pipeline's opencode CLI
-                                     # version (the opencode backend is
-                                     # offline-tests-only in production
-                                     # but the env var is still referenced
-                                     # by pipelines/common.py).
+                                      # version (the opencode backend is
+                                      # offline-tests-only in production
+                                      # but the env var is still referenced
+                                      # by pipelines/common.py).
 # ── end Workflow tunables ──────────────────────────────
+
+# ── v1.4 notes ──────────────────────────────────────────
+# The workflow YAML auto-masks the above secret values in CI
+# logs via `::add-mask::` (REQ-INB-56). Do not echo them in
+# custom `run:` steps; the mask only protects values Gitea
+# Actions sees, not values that are echoed in plain text.
diff --git a/.gitea/workflows/ci-pr.yml b/.gitea/workflows/ci-pr.yml
index 595a50a..15e6be5 100644
--- a/.gitea/workflows/ci-pr.yml
+++ b/.gitea/workflows/ci-pr.yml
@@ -69,6 +69,15 @@ jobs:
       # Quiet per-message logging in the offline tests.
       LOG_LEVEL: "WARNING"
     steps:
+      # v1.4 REQ-INB-56: secret-redaction mask for the 9 secret env vars
+      - name: Secret mask (REQ-INB-56)
+        run: |
+          for v in IMAP_PASSWORD NOCODB_API_TOKEN NOCODB_API_TOKEN_READONLY GITEA_USER GITEA_PASS SEAWEEDFS_S3_ACCESS_KEY SEAWEEDFS_S3_SECRET_KEY PAPRA_API_TOKEN OLLAMA_API_KEY; do
+            val="${!v:-}"
+            if [ -n "$val" ]; then
+              echo "::add-mask::$val"
+            fi
+          done
       - name: Checkout repo
         uses: actions/checkout@v4
 
diff --git a/.gitea/workflows/historical-pipeline.yml b/.gitea/workflows/historical-pipeline.yml
index 3de9acd..7ff8f9f 100644
--- a/.gitea/workflows/historical-pipeline.yml
+++ b/.gitea/workflows/historical-pipeline.yml
@@ -84,6 +84,15 @@ jobs:
     env:
       PYTHONUNBUFFERED: "1"
     steps:
+      # v1.4 REQ-INB-56: secret-redaction mask for the 9 secret env vars
+      - name: Secret mask (REQ-INB-56)
+        run: |
+          for v in IMAP_PASSWORD NOCODB_API_TOKEN NOCODB_API_TOKEN_READONLY GITEA_USER GITEA_PASS SEAWEEDFS_S3_ACCESS_KEY SEAWEEDFS_S3_SECRET_KEY PAPRA_API_TOKEN OLLAMA_API_KEY; do
+            val="${!v:-}"
+            if [ -n "$val" ]; then
+              echo "::add-mask::$val"
+            fi
+          done
       - name: Checkout repo
         uses: actions/checkout@v4
 
diff --git a/.gitea/workflows/live-pipeline.yml b/.gitea/workflows/live-pipeline.yml
index 55a16ae..ce12b3f 100644
--- a/.gitea/workflows/live-pipeline.yml
+++ b/.gitea/workflows/live-pipeline.yml
@@ -86,6 +86,15 @@ jobs:
     env:
       PYTHONUNBUFFERED: "1"
     steps:
+      # v1.4 REQ-INB-56: secret-redaction mask for the 9 secret env vars
+      - name: Secret mask (REQ-INB-56)
+        run: |
+          for v in IMAP_PASSWORD NOCODB_API_TOKEN NOCODB_API_TOKEN_READONLY GITEA_USER GITEA_PASS SEAWEEDFS_S3_ACCESS_KEY SEAWEEDFS_S3_SECRET_KEY PAPRA_API_TOKEN OLLAMA_API_KEY; do
+            val="${!v:-}"
+            if [ -n "$val" ]; then
+              echo "::add-mask::$val"
+            fi
+          done
       - name: Checkout repo
         uses: actions/checkout@v4