How doest secret works?

[mrhackcz]

Hi there,

I'm currently playing around with version 8 and came across secret, which could be useful. But I don't quite understand how it's supposed to work. Could someone please explain it to me? What's the difference between using %secret% and not using it?

Thanks

desc('Test secret');
task('test:secret', function () {
    run('echo "This should be redacted:" %secret%', secret: getenv('SECRET_STRING'));
    run('echo ' . getenv('SECRET_STRING'));
})->once();

vader@deathstar:~$ export SECRET_STRING=CallMeDaddy
vader@deathstar:~$ dep test:secret  -vv
task test:secret
[www1] run echo "This should be redacted:" CallMeDaddy
[www1] This should be redacted: CallMeDaddy
[www1] run echo CallMeDaddy
[www1] CallMeDaddy
done on www1
done test:secret 132ms

[antonmedv]

Idea was to hide this "secret" from the logs only. Obviously we command you running should have access to it. cat/echo secret would reveal it. I think we need to get rid of this option all together.

[antonmedv]

The correct way to use "secrets", is via env vars:

run('echo "This should be redacted:" $SECRET', env: ['SECRET' => getenv('SECRET_STRING')]);

[mrhackcz]

Yeah, right. The example with echo isn't the best. My actual usage is this:

desc('Export envs from Infisical to .env file');
task('infisical:env:export', function () {
    cd('{{release_or_current_path}}');
    run('infisical export --projectId "123.456.789"' .
        ' --path /  --env production --format=dotenv --output-file .env',
        ['env' => [
            'INFISICAL_API_URL' => getenv('INFISICAL_API_URL'),
            'INFISICAL_TOKEN' => run('infisical login --method=universal-auth --silent --plain',
                ['env' => [
                    'INFISICAL_API_URL' => getenv('INFISICAL_API_URL'),
                    'INFISICAL_UNIVERSAL_AUTH_CLIENT_ID' => getenv('INFISICAL_UNIVERSAL_AUTH_CLIENT_ID'),
                    'INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET' => getenv('INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET'),
                ]])
        ]]
    );
});

The main problem is, that INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET is printed in verbose log.
The second problem is that output of login command is also printed in log. Which is access token.

dep infisical:env:export -v

task infisical:env:export
[www1] run export UV_CACHE_DIR='/var/.cache/uv'; if [ -h /var/www/service/release ]; then echo +legitimate; fi
[www1] run export UV_CACHE_DIR='/var/.cache/uv' INFISICAL_API_URL='https://domain.cz' INFISICAL_UNIVERSAL_AUTH_CLIENT_ID='yyyyyyy-xxxxxxx' INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET='123456789'; cd /var/www/service/current && (infisical login --method=universal-auth --silent --plain)
^^^ I NEED TO HIDE CONTENT of "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"

[www1] printedTimeLimitedToken 
I^^^ AND ALSO THIS

[www1] run export UV_CACHE_DIR='/var/.cache/uv' INFISICAL_API_URL='https://domain.cz' INFISICAL_TOKEN='timeLimitedToken'; cd /var/www/service/current && (infisical export --projectId "project_id" --path / --env production --format=dotenv --output-file .env)
[www1] Successfully exported secrets to: /var/www/service/current/.env

I can also pass the secret as argument in command via infisical login --client-secret=<client-secret> and here I thought secret could be usefull :)