Skip to content

Commit 9f1975d

Browse files
vladfranguvladfrangu
authored
chore: mask secrets in CI runs (#789)
1 parent 8228c15 commit 9f1975d

File tree

12 files changed

+75
-29
lines changed

12 files changed

+75
-29
lines changed

‎.github/workflows/check.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ jobs:
2222
node-version: [18, 20, 22]
2323

2424
steps:
25+
- name: Mask secrets
26+
run: |
27+
echo "::add-mask::${{ secrets.APIFY_TEST_USER_API_TOKEN }}"
28+
2529
- uses: actions/checkout@v4
2630

2731
- name: Use Node.js ${{ matrix.node-version }}
@@ -61,6 +65,10 @@ jobs:
6165
runs-on: ${{ matrix.os }}
6266

6367
steps:
68+
- name: Mask secrets
69+
run: |
70+
echo "::add-mask::${{ secrets.APIFY_TEST_USER_API_TOKEN }}"
71+
6472
- uses: actions/checkout@v4
6573

6674
- name: Use Node.js 20

‎.github/workflows/cucumber.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ jobs:
2323
runs-on: ${{ matrix.os }}
2424

2525
steps:
26+
- name: Mask secrets
27+
run: |
28+
echo "::add-mask::${{ secrets.APIFY_TEST_USER_API_TOKEN }}"
29+
2630
- uses: actions/checkout@v4
2731

2832
- name: Use Node.js ${{ matrix.node-version }}

‎eslint.config.mjs‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,4 +74,16 @@ export default [
7474
'consistent-return': 'off',
7575
},
7676
},
77+
{
78+
files: ['test/**/*'],
79+
rules: {
80+
'no-restricted-syntax': [
81+
'error',
82+
{
83+
'selector': "CallExpression[callee.object.name='LoginCommand'][callee.property.name='run']",
84+
'message': 'Use safeLogin() from test/__setup__/hooks/useAuthSetup.ts instead',
85+
},
86+
],
87+
},
88+
},
7789
];

‎test/__setup__/config.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
1+
import { EOL } from 'node:os';
2+
13
import { ApifyClient } from 'apify-client';
4+
import isCI from 'is-ci';
25

36
import { getApifyClientOptions } from '../../src/lib/utils.js';
47

@@ -14,3 +17,8 @@ export const testUserClient = new ApifyClient(getApifyClientOptions(ENV_TEST_USE
1417
export const badUserClient = new ApifyClient(getApifyClientOptions(TEST_USER_BAD_TOKEN));
1518

1619
export const TEST_USER_TOKEN = ENV_TEST_USER_TOKEN;
20+
21+
if (isCI) {
22+
process.stdout.write(`CI environment detected, masking secrets as they are created${EOL}`);
23+
process.stdout.write(`${EOL}::add-mask::${TEST_USER_TOKEN}${EOL}`);
24+
}

‎test/__setup__/hooks/useAuthSetup.ts‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
11
import { rm } from 'node:fs/promises';
2+
import { EOL } from 'node:os';
3+
4+
import isCI from 'is-ci';
25

36
import { cryptoRandomObjectId } from '@apify/utilities';
47

8+
import { LoginCommand } from '../../../src/commands/login.js';
59
import { GLOBAL_CONFIGS_FOLDER } from '../../../src/lib/consts.js';
10+
import { getLocalUserInfo } from '../../../src/lib/utils.js';
11+
import { TEST_USER_TOKEN } from '../config.js';
612

713
export interface UseAuthSetupOptions {
814
/**
@@ -43,3 +49,18 @@ export function useAuthSetup({ cleanup, perTest }: UseAuthSetupOptions = { clean
4349
vitest.unstubAllEnvs();
4450
});
4551
}
52+
53+
export async function safeLogin(tokenOverride?: string) {
54+
// eslint-disable-next-line no-restricted-syntax
55+
await LoginCommand.run(['--token', tokenOverride ?? TEST_USER_TOKEN], import.meta.url);
56+
57+
try {
58+
const userInfo = await getLocalUserInfo();
59+
60+
if (userInfo?.proxy?.password && isCI) {
61+
process.stdout.write(`${EOL}::add-mask::${userInfo.proxy.password}${EOL}`);
62+
}
63+
} catch {
64+
// Do nothing
65+
}
66+
}

‎test/commands/call.test.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,10 @@ import { captureOutput } from '@oclif/test';
66

77
import { cryptoRandomObjectId } from '@apify/utilities';
88

9-
import { LoginCommand } from '../../src/commands/login.js';
109
import { getLocalKeyValueStorePath } from '../../src/lib/utils.js';
1110
import { waitForBuildToFinishWithTimeout } from '../__setup__/build-utils.js';
12-
import { TEST_USER_TOKEN, testUserClient } from '../__setup__/config.js';
13-
import { useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
11+
import { testUserClient } from '../__setup__/config.js';
12+
import { safeLogin, useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
1413
import { useTempPath } from '../__setup__/hooks/useTempPath.js';
1514

1615
const ACTOR_NAME = `call-my-actor-${cryptoRandomObjectId(6)}-${process.version.split('.')[0]}-${platform()}`;
@@ -48,7 +47,7 @@ describe('apify call', () => {
4847

4948
const { username } = await testUserClient.user('me').get();
5049

51-
await LoginCommand.run(['--token', TEST_USER_TOKEN], import.meta.url);
50+
await safeLogin();
5251
await CreateCommand.run(
5352
[ACTOR_NAME, '--template', 'project_empty', '--skip-dependency-install'],
5453
import.meta.url,

‎test/commands/info.test.ts‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,8 @@ import { readFileSync } from 'node:fs';
33
import { runCommand } from '@oclif/test';
44

55
import { InfoCommand } from '../../src/commands/info.js';
6-
import { LoginCommand } from '../../src/commands/login.js';
76
import { AUTH_FILE_PATH } from '../../src/lib/consts.js';
8-
import { TEST_USER_TOKEN } from '../__setup__/config.js';
9-
import { useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
7+
import { safeLogin, useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
108

119
useAuthSetup();
1210

@@ -20,7 +18,7 @@ describe('apify info', () => {
2018
it('should work when logged in', async () => {
2119
const spy = vitest.spyOn(console, 'log');
2220

23-
await LoginCommand.run(['--token', TEST_USER_TOKEN], import.meta.url);
21+
await safeLogin();
2422
await InfoCommand.run([], import.meta.url);
2523

2624
const userInfoFromConfig = JSON.parse(readFileSync(AUTH_FILE_PATH(), 'utf8'));

‎test/commands/log_in_out.test.ts‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import type { MockInstance } from 'vitest';
55

66
import { AUTH_FILE_PATH } from '../../src/lib/consts.js';
77
import { TEST_USER_BAD_TOKEN, TEST_USER_TOKEN, testUserClient } from '../__setup__/config.js';
8-
import { useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
8+
import { safeLogin, useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
99

1010
vitest.setConfig({ restoreMocks: false });
1111
useAuthSetup();
@@ -25,14 +25,14 @@ describe('apify login and logout', () => {
2525
});
2626

2727
it('should end with Error with bad token', async () => {
28-
await LoginCommand.run(['--token', TEST_USER_BAD_TOKEN], import.meta.url);
28+
await safeLogin(TEST_USER_BAD_TOKEN);
2929

3030
expect(spy).toHaveBeenCalledTimes(1);
3131
expect(spy.mock.calls[0][0]).to.include('Error:');
3232
});
3333

3434
it('should work with correct token', async () => {
35-
await LoginCommand.run(['--token', TEST_USER_TOKEN], import.meta.url);
35+
await safeLogin(TEST_USER_TOKEN);
3636

3737
const expectedUserInfo = Object.assign(await testUserClient.user('me').get(), {
3838
token: TEST_USER_TOKEN,
@@ -67,6 +67,7 @@ describe('apify login and logout', () => {
6767
});
6868

6969
it('have correctly setup server for interactive login', async () => {
70+
// eslint-disable-next-line no-restricted-syntax -- intentional test
7071
await LoginCommand.run(['-m', 'console'], import.meta.url);
7172

7273
const consoleInfo = spy.mock.calls[0][1];

‎test/commands/pull.test.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,9 @@ import { join } from 'node:path';
55
import { runCommand } from '@oclif/test';
66
import type { ActorCollectionCreateOptions } from 'apify-client';
77

8-
import { LoginCommand } from '../../src/commands/login.js';
98
import { DEPRECATED_LOCAL_CONFIG_NAME, LOCAL_CONFIG_PATH } from '../../src/lib/consts.js';
10-
import { TEST_USER_TOKEN, testUserClient } from '../__setup__/config.js';
11-
import { useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
9+
import { testUserClient } from '../__setup__/config.js';
10+
import { safeLogin, useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
1211
import { useProcessMock } from '../__setup__/hooks/useProcessMock.js';
1312

1413
const TEST_ACTOR_SOURCE_FILES: ActorCollectionCreateOptions = {
@@ -111,7 +110,7 @@ describe('apify pull', () => {
111110
const actorNamesForCleanup = new Set<string>();
112111

113112
beforeAll(async () => {
114-
await LoginCommand.run(['--token', TEST_USER_TOKEN], import.meta.url);
113+
await safeLogin();
115114
});
116115

117116
afterAll(async () => {

‎test/commands/push.test.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ import { cryptoRandomObjectId } from '@apify/utilities';
99

1010
import { LOCAL_CONFIG_PATH } from '../../src/lib/consts.js';
1111
import { createSourceFiles, getActorLocalFilePaths, getLocalUserInfo } from '../../src/lib/utils.js';
12-
import { TEST_USER_TOKEN, testUserClient } from '../__setup__/config.js';
13-
import { useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
12+
import { testUserClient } from '../__setup__/config.js';
13+
import { safeLogin, useAuthSetup } from '../__setup__/hooks/useAuthSetup.js';
1414
import { useConsoleSpy } from '../__setup__/hooks/useConsoleSpy.js';
1515
import { useTempPath } from '../__setup__/hooks/useTempPath.js';
1616
import { resetCwdCaches } from '../__setup__/reset-cwd-caches.js';
@@ -43,7 +43,6 @@ const {
4343
forceNewCwd,
4444
} = useTempPath(ACTOR_NAME, { create: true, remove: true, cwd: true, cwdParent: true });
4545

46-
const { LoginCommand } = await import('../../src/commands/login.js');
4746
const { CreateCommand } = await import('../../src/commands/create.js');
4847
const { ActorsPushCommand } = await import('../../src/commands/actors/push.js');
4948

@@ -55,7 +54,7 @@ describe('apify push', () => {
5554
beforeAll(async () => {
5655
await beforeAllCalls();
5756

58-
await LoginCommand.run(['--token', TEST_USER_TOKEN], import.meta.url);
57+
await safeLogin();
5958
await CreateCommand.run([ACTOR_NAME, '--template', ACT_TEMPLATE, '--skip-dependency-install'], import.meta.url);
6059

6160
toggleCwdBetweenFullAndParentPath();

0 commit comments

Comments
 (0)